The DMZ - 2013-03-14 (page 1 of 2)

« first day (819 days earlier) ← previous day next day → last day (4082 days later) »

12:12 AM

Morning.

Noooooooooo: arstechnica.com/information-technology/2013/03/…

@TerryChia Wow, that sucks.

Oh, have you guys seen Kali Linux?

@TerryChia You haven't gone through the chat transcript, have you?

;-)

@Xander Ahh nope. It's too damn long.

LOL!

12:17 AM

So what did I miss?

Yeah, we discussed it a few hours ago. I got it installed this afternoon.

Cool, how is it so far?

Interesting ports they did. Chromebook?!?!?!

Like Backtrack. But built on Debian instead of Ubuntu.

I hadn't had much of a chance to use BT, so there aren't a lot of changes that are readily apparent to me, at least.

I'm downloading the images right now. Too bad they no longer have the KDE version.

Yeah, that's a fairly significant change.

12:21 AM

I have a Pi coming in tomorrow so I'll test Kali on that. I wonder how the hardware will hold up.

So Kali is the new BackTrack?

@TildalWave Yes.

^^^^^^ just found it too: kalilinux.net/community/threads/the-birth-of-kali-linux.18

4 hours later…

4:49 AM

@LucasKauffman What's going on with the CTF?

What's gonna happen?

2 hours later…

6:23 AM

@TerryChia ah we shall play, I've planned one we can do, I'll be unavailable on saturday because I need to go look at an appartment

think we will be playing ctf.forbiddenbits.net

@LucasKauffman Don't forget to register. :)

1 hour later…

7:34 AM

@Terry - is there a replacement for Reader

@RoryAlsop Not sure yet. Apparently a lot of the existing readers were just frontends for Google's service. :(

8:17 AM

@RoryAlsop not from google. There's threads on Reddit and news.yc about possible replacements. Looks like most of them are a little slammed with people checking them out at the moment. (reddit thread - reddit.com/r/technology/comments/1a8ygk/… ) (news.yc news.ycombinator.com/item?id=5371725)

it's a bummer I like my Feed Reading!

@RoryMcCune Yeah.. I hope the replacements will work well enough..

@TerryChia newsblur looks nice though I'll wait a day or two to check it out .. at $1 a month it won't break the bank for the paid for version either..

8:50 AM

sigh, still it's one less thing that I'll now use google for

I'm going to download this

9:05 AM

For people who have tried Kali Linux, any idea where stuff like wordlist are located?

9:23 AM

@RoryMcCune yeah, but you still might have parser issues. Not all parser support all structures, and for that matter not all parsers currently allow DTD.

and those that do, should be configured in code to disallow it.

@RoryAlsop unfortunately, yes - not a fluffy white one though, but my neighbor likes playing with stray cats, so they tend to hang around across from my window :@

@RoryAlsop didn't you hear? Bears and Sharks are natural allies. collegehumor.com/video/6876774/bearshark-money

@LucasKauffman she was actually younger than you! :D:D

9:39 AM

@LucasKauffman instead of showing the web page, show the captured request/response, e.g. from Fiddler.

@LucasKauffman I too used to be a slave to the culture of "report by thickness" (the quality of report is judged by the thickness of the mound of papers when the report is printed out.)

but a better angle would be to "take credit" for their security, even when you dont find anything.

You're in the Big 4, you could pull that off.

More ethically, there is value in proving a certain level of security, or rather proving that certain issues do not exist.

So even if you find very few findings, your review could still have been awesome, and still can bring a lot of value. It's all in the positioning.

Some would call that "spin"...

Anybody else wanna jump in here? This is the guy that doesnt want to deal with the virus...

No. We very probably did deal with it properly. We simply don't know if it is a virus, hence me asking here if it is a known behaviour of a virus. Why take the car in for a new engine if it is just the oil? I would also have thought here was a great place to ask if that behaviour is known virus behaviour. I think we're done here. — Matt Parkins 13 mins ago

@AviD I think you should just apply the finishing close vote.

It's already got 4/5.

yeah, I guess... Didnt feel that "what he needed to know" was offtopic, so I was trying to bring him around to that.

@AviD yeah we do web app reporting by methodology which works well for this. So you step through the methodology and say what was tested for each stage and what the outcome was. shows you did some work and also lets the app. owner show they've done some stuff right, whilst keeping up the report length where there aren't a lot of findings.

@RoryMcCune yeah, that is necessary for some of the heavier corps. Myself, I have no problem with a short report, if it shows its value.

Clients may disagree, though.

@AviD Wanna throw this over to the folks at SU?

0

Q: Can File Sharing being Controlled by Mac Address?

I am currently setting up secure environment between 2 pc in isolated network. Just wondering can we do file sharing based on that pc mac address instead of username? The environment is OEM Windows 7

Isn't strictly a security topic.

9:52 AM

@TerryChia not what he wants to be asking, no. But I think the real question is "should this be done".

@AviD In that case the answer is no. Should I write a short answer explaining why or do you want to migrate it?

@TerryChia First I want the OP to clarify intentions. If they ask why, then yeah, otherwise I'll throw it over.

@AviD Aye. :)

Kali Linux is looking to be a real nice change from Backtrack. Real convenient having everything accessible in $PATH.

Although I still can't find the wordlist that comes by default with Backtrack. Can anyone confirm that Kali Linux doesn't have it before I upload my own?

@TerryChia I've been thinking of making a repository on GIT with wordlists

something which is easily updateable

@LucasKauffman Cool. Let me know the link if you do. Could help manage and update it as well if needed.

10:00 AM

remind me to set it up during the weekend

I forget things

@TerryChia there are word lists specific to every tool. Right now I am installing. In five minutes I am going to update

Also anyone heard of screen scraping to enhance security?

@void_in Where are they located? Can't seem to find them.

@LucasKauffman Roger.

@LucasKauffman yeah, there are some products that do that.

I assume you dont mean on the endpoint, but like a greenscreen screenscraper middleware.

@TerryChia find / -name wordlist for now

10:03 AM

@AviD yea I have a Frontend -> screenscraper -> backend

"to improve security" not sure how much that happens directly, but you do have more options that way.

@void_in Ahhh. They are all located in the /usr/share directory.

the end user does not interact directly with the backends (which often dont care much about security) so you can do all kinds of validations, authorizations, etc.

Whether they do or not is a different question.

@AviD thanks

@TerryChia yes. Organized under each tool directory. A common one is at /usr/share/hunspell/en_US.dic

10:09 AM

@void_in Yeah. :) Neat way to organize it compared to Backtrack.

@TerryChia The best thing I like about Kali is the top 10 security tools. Honestly I use only these 80% of the times

10:32 AM

user image

@LucasKauffman Torrent...

@JeffFerland I'm at work :(

@LucasKauffman heh. i torrented like 5 different versions.

Heei everybody!

@Lucas be we registered for le CTF?

10:48 AM

@AntonyVennard yes we are!

@TerryChia Yeah! Good good :) I'll be around at the start, out for friday eve and back in saturday. I head you saying you'd be away saturday, right?

heard=read here

@AntonyVennard not me. i'll be around. at least for a couple of hours to take part.

Oh Sorry, wrong person! I meant @Lucas !

/me totes has a copy of kali

@Ninefingers CTF?

friday evening?

(, ), also known as (), is the Hindu goddess associated with empowerment, shakti. The name Kali comes from kāla, which means black, time, death, lord of death, Shiva. Since Shiva is called Kāla—the eternal time—Kālī, his consort, also means "Time" or "Death" (as in time has come). Hence, Kāli is the Goddess of Time and Change. Although sometimes presented as dark and violent, her earliest incarnation as a figure of annihilator of evil forces still has some influence. Various Shakta Hindu cosmologies, as well as Shākta Tantric beliefs, worship her as the ultimate reality or Brahman...

11:17 AM

@AviD JESUS! This looks like the opposite of Rama

@AviD, also, there should be some way to get SuperCollider notifications in a chat room.

@AviD I went to a temple of Kali once in India... not the sort of place you take your shoes off in (in other temples you had to take your shoes off..)

@RoryMcCune So nobody likes Kali?

@Adnan also, the opposite of Jesus.

@Adnan well someone must as they have temples to her..

@RoryMcCune Isn't Kali the goddess of assassins?

26

Q: Alternatives for Google Reader

Now that Google Reader is being retired, what are my options for consuming RSS feeds on the web and synchronizing with my Android device? Social media sharing is not as important to me as being able to keep up with many disparate sites/feeds in a single place and for the data to be stored in the ...

webapp-rec rss-reader

11:24 AM

@AviD well I'd be reverting to my DnD knowledge here rather than real-world but yeah I think so.

@AviD It's funny because Assassins could be adjusted a little and translated to "Potheads" in Arabic.

@Adnan I dont think that's coincidence - going back to the original Hindu assassins...

@AviD That self hosting option looks pretty interesting.

@TerryChia I thought so too, but I cant get to the page?

@TerryChia I get:

It works! This is the default web page for this server. The web server software is running but no content has been added, yet.

@AviD I managed to get to the low bandwidth version of it: tt-rss.org

11:28 AM

nope.

huh. I can see it on Chrome, but not IE.

What's with all the anti-IE bigotry lately??

@AviD Lately?

@RoryAlsop Well, I've decided my memories from France tell me it's too damn cold to ride and the pricing of car rental or train tickets precludes the journey :(

Hasn't it been that way for a couple of years now?

@TerryChia never had a problem, until recently.

@AntonyVennard check the CTF Team chat, posted our credentials there

11:29 AM

@TerryChia no, it was always the other way around.

@LucasKauffman THanks.

@AviD I usually get rendering issues. First time I see a site completely blocking IE though.

yeah. not the first, but its only recent.

IE and Firefox are now the only major non-webkit browsers.

Developers are just lazy I guess.

yeah, it looks interesting, but I wouldnt run it on my primary server. It needs PHP.

I guess I can throw a mini-VM at it, mebbe load up a thin Linux distro on it...

11:33 AM

@AviD heh. I'm already running PHP due to wordpress.

when I get around to it.

have a few months...

@TerryChia I... am so sorry.

@AviD The python/ruby alternatives just weren't mature enough. :(

@TerryChia there is nothing mature about PHP.

but I guess you mean wordpress...

@AviD Yeah, that.

@AviD apart from the bugs... some of those have been around for ever :)

11:35 AM

@RoryMcCune So PHP is kinda like @RoryAlsop?

4

@RoryMcCune being old is never a sign of maturity.

@TerryChia I was trying to be more subtle about it... ;-)

@TerryChia oh man that's harsh

@JeffFerland boo. but yeah it is pretty chilly up here at the moment...

@AviD the missus has had loads of problems with IE 10 at the mo. mainly 'cause devs write things like (if IE8 do x, or if IE7 do y else it's IE6)

@RoryMcCune yeah, that's just plain buggy.

tbf almost any browser-sniffing scripts is plain wrong.

@RoryMcCune Hmm really? I never actually encountered code like that.

I only see browser-specific css often.

@TerryChia try surfing with IE10 and when you see sites acting like it's IE6 ....

@AviD although it did used to be needed 'cause IE6 was downright weird

11:39 AM

there are a few CSS attributes you need to multiply, for the non-CSS3-compliant browsers (FF+Webkit - IE is the good one here :-) ), but for the most part JS should be agnostic.

@TerryChia ALL.THE.TIME.

@AviD Yeah, isn't IE being compliant ironic?

@RoryMcCune While this is true, people tend to forget that it was SO much better than anything else at the time.

But heck, the pragmatic side of me thinks they should just make webkit the new standard....

Developers already treat it that way.

@AviD oh yeah when it launched it was, if that had just updated it regularly it would've been fine..

@TerryChia meh. Dont forget most of the original legacy IE code was written before there were standards. That's all gone now.

11:41 AM

but it became a huge burden to devs (literally I saw stats saying that they were spending 20-30% of the whole development time just making it work with IE6)

There is a reason it reached >90% usage back in the day.

IE 10 is actually pretty nice. It's just having a hard time shaking off the bad reputation.

@RoryMcCune pshaw. Everything used to be like that.

@TerryChia Sure. As many of MS's products do.

@AviD true but last couple of years, standard development gets you a long way and they then need to go back and just do IE6 stuff...

@RoryMcCune Absolutely.

I've pushed to just ignore everything before IE8 period.

11:43 AM

@AviD yep some people don't know that the poster child of web 2.0 AJAX was an MS invention for use with OWA

IE8 itself was also under discussion...

@RoryMcCune yeah! and the IE6 DOM made webdev modern.

'Course back then we didnt call it AJAX...

@AviD I just don't see the point of having a third browser when I already have Chrome + FF.

@TerryChia So switch to Chrome + IE.

And all my damned bookmarks are on Chrome.

What do you need FF for? It sucks. Sucks hard.

UX preferences aside, note that FF is the only modern browser that still uses a single process, no matter how many windows and tabs you have open.

That's just wrong.

11:45 AM

@AviD is actually getting better these days. FF is my testing browser of choice thanks to the web developer toolbar and limited interference from XSS protections in the browser..

@AviD I use some of the plugins for pentesting.

@avid Firebug is still better than the Chrome developer tools.

More convenient than starting up my BT VM in some instances.

dunno, I've tried them out, still not as good as what I have in IE.

built-in security protections aside.

which, of course, is a point towads IE - it's harder to exploit? duh.

I do use FF sometimes, though... mainly for keeping my streaming separate from my other browsers (IE+GC), sometimes for testing something that just didnt work on the other browsers, but should have.

I have just noticed that Ctrl+G can also be used for in-page search in Firefox

Good guy Firefox, expects that its users might miss the "F"

11:53 AM

@Adnan Not quite. ctrl+g and command+g have been the shortcuts for "Search again" since the days of the Mac Classic. (At least, that's where I first discovered that shortcut.)

@Ladadadada and you had to ruin it by your facts and correct information.

@Adnan I get that all the time. It's a curse.

12:10 PM

@Ladadadada ah, classic apple... "G" for searchinG.

user image

@Xander did you ever try dragonfly?

@LucasKauffman Nope. Should I? Is it for Firefox?

Or Chrome?

@Xander It's actually in Opera, I know not a lot of people are fan of opera, but that feature was really nice

opera.com/dragonfly

@LucasKauffman Interesting. I use Opera from time to time. It's a fine browser, I just haven't found much compelling about it. I'll check it out.

@LucasKauffman I used to use Opera, a loooong time ago. Back when "Browser Wars" really meant something... and Netscape sucked almost as much as IE.

12:23 PM

Opera is nice, and as hardly anyone uses it, hardly anyone writes exploits for it :)

@LucasKauffman @ColinCassidy It'll be interesting to see how it changes once they get it converted to WebKit.

@ColinCassidy isnt now webkit based too? So that shouldnt matter, if its the same engine...

@AviD yup webkit.

@AviD This is bad. Really bad.

@AviD Is it actually yet? I thought they just announced that they would be converting in the last couple of weeks.

12:27 PM

@Xander The next release I think. The latest one is still using their own engine.

The webkit one is already in beta though IIRC.

@TerryChia Ah, ok. Yeah, the Googles tells me that they have a beta Android browser that's WebKit already, at least.

oh, my bad.

@AviD Shouldn't be long now though, I wouldn't guess.

Hmm, getting confused with graphics card and dual/triple monitor setups. If I eventually want to go for three Dell U2312HM screens, which has 1 DVI-D and 1 DP port, what sort of video output should I get on my graphics card?

@TerryChia you could manage pretty well with a card that has double dual-dvi and double HDMI (just to have an extra one - or settle for one HDMI), and use an adapter for the HDMI.

that's what I just got... just make sure its powerful enough to run the screens. especially memory.

BTW, I think you should skip paying the premium on the Dells, and go for the Koreans.

maybe even bump it up to 27-inchers...

12:47 PM

@ThomasPornin Oh I loved the book. I just got around to reading it a few months ago. I put it away thinking that I would have been a smarter person had I read it younger.

Am I the only person feeling all sandy now that Reader is being shut down?

@ScottPack "Sandy" is not the word I would have used to describe it. But whatever I'm feeling about Google Reader now it's not warm and fuzzy.

I was thinking of this kind of sandy.

@ScottPack @Ladadadada It's a shame. And it's going to be a hassle. So yeah, I'm not thrilled either.

@Xander I've got 123 feeds to find a new home for. I would prefer it to stay up, but I would accept open sourcing.

@AviD I want to get matching monitors. :P

@AviD Thanks, that rules out quite a few cards I was looking at.

12:55 PM

@TerryChia amazon.com/gp/product/B009AEL4ES

I liked this one.

Not exactly top of the line, but well enough to do me well.

@ScottPack What I'm going to miss most is the infrastructure. They're so good at archiving feeds I never have to worry about missing anything, or not being able to search and find an old post, even if it's from before I subscribed to the feed. I can't see an alternative having those kinds of resources.

or you could jump up to the GTX 680/690, but thats quite a bit pricier.

some of the radeons would be a good fit too, if you dont prefer nvidia.

@ScottPack I'm sure there'll end up being reasonable alternatives though. I haven't started looking for one yet, so we'll see what turns up.

@AviD The 680/690's are out of my price range for sure. I'm looking along the HD 7850 range, or even the HD 6850 from the previous generation as my needs are quite modest.

@AviD I had a radeon once. Then I installed linux on it and had the pain of getting the radeon drivers to work. The situation may have got better, but I'm still scarred and to this day only buy nvidia.

12:58 PM

@Xander I've got a few leads, but I'm not sure how they're going yet.

@ScottPack I'd appreciate any tips if you find any you particularly like.

@AntonyVennard had a similar (though non-linux) situation too.

@Xander Indeed.

@Xander I'm really considering hosting it myself on my own VPS tbh.

also, back when I first learned this stuff, nvidia had much cooler technology than (what was it back then?) ATI.

@TerryChia I think the gtx 650 fits that price range. this one was a bit pricier because I wanted the 2GB model.

there are cheaper ones, too.

1:00 PM

The nvidia cards have a good lead over AMD in games due to optimizations.. I think the AMD card still has a slight edge in graphics computing though.

@Xander @ScottPack ditto.

0

Q: NIST hacked – best practices in a “Nuke it from orbit” often world

This week we have NIST’s vulnerabilities database offline due to being hacked and Microsoft patching a USB physical attack that takes over every version to date with just an insertion of a thumb drive. From my point of view the these two events are the endpoint on a trend line suggesting system ...

defense data-recovery availability design-flaw

I don't really like this question, though I can't place my finger on what's wrong.

@TerryChia So they say. TBH I'm not sure I would notice the difference enough, as long as its stable, for most of my computing needs, as long as the rest of the system isnt the chokepoint.

@TerryChia maybe its the design-flaw tag. Really?

but yeah, its just a bit wide open and undefined. I think it could stand a good tightening up.

Oh, hi all. Just closed it. :-/

Basically, use mandatory access control.

@AviD The drivers, back in the day, utterly sucked. Not sure if that was the case for Windows but it was when trying Ubuntu. I'm sure things have probably got an awful lot better, but I can't shake it. Nvidia's drivers have never let me down (yet)

1:12 PM

@AntonyVennard Also, something to be said for competition in the board makers, using the same chip - as opposed to the single vendor.

Of course, there is something to be said for the opposite, too.

@JeffFerland could stand for an explanatory comment, methinks.

1:27 PM

@jrg SHELDON!

Also, on that question, having backups is great and restoring from them is great, but you also need to understand the exploit vector and how to patch it so you don't just get hit twice. Suspect that is what is taking time.

@TerryChia eh?

@jrg Nothing. :)

0

Q: Is it possible that AES could be broken?

Much like DES was broken for years, but never truly released to the public until quite some time later. I know that AES was more open to the public when it was initially developed, and many proposed models were rejected. However, could it be broken somehow, but not announced to the public. Or is ...

encryption aes des

Bad question is bad.

@TerryChia agreed.

"Is it possible that there is something that we don't know about?" There is really no possible way this can be answered sensibly. — AviD 42 secs ago

I really shouldnt be moderating today. I'm too cranky.

1:50 PM

@AviD relax @avid

@AviD I believe I could have answered that sensibly. Perhaps even interestingly.

@ThomasPornin proven wrong by the bear. As usual.

Really? Should I reopen it? Or are you just going to use it as an excuse for some snark?

@ThomasPornin You could answer sensibly and interesting on every question, that's the power of the bear!

Heh @LucasKauffman, lmgtfy really?

@AviD If you reopen it, I'll answer.

1:54 PM

@ThomasPornin of course it is possible, or will be sometime. That's not interesting.

@AviD You could reopen, let the Bear pop in his answer before closing it again.

Slight abuse of power though. ;)

@ThomasPornin I think it's also OT - more crypto than sec.se.

@TerryChia @AviD isn't the only cranky one today, I was stuck in traffic for 2 hours, missed 2 meetings

The World won't crash into oblivion if you do not reopen that question.

2

@LucasKauffman :(

1:55 PM

@LucasKauffman oh sucks.

@ThomasPornin hehe, here comes the snark.

and my client I had to go to is on strike today so I'm benched

@ThomasPornin what would be the one-line executive summary?

@LucasKauffman Stuck in traffic for 2 hours would make me cranky - but missing the 2 meetings might be worth it.

@Iszi one of them I don't really care, but the other was with a CIO, was nice for visibility

@Iszi no -then you just have to reschedule, plus add time for apologies.

1:57 PM

@AviD "It is possible but improbable". News about breakage travel fast (cue citations about War-time Enigma, differential cryptanalysis, and Leibniz).

@JeffFerland That's a pity - but to be honest, it is bitterly cold up here, so you'd have wanted to be in some pretty well insulated kit!

@ThomasPornin yeah, I assumed as much. That's not really answering the question though, but its as close as one could get.

The citations would probably be interesting, but overall still not constructive.

Thanks, though.

@ThomasPornin if that's true in general for all decent crypto, we can make a general question?

@LucasKauffman Actually it's true of all of security (IT or not), and can be generalized to the whole of Science.

@ThomasPornin which is exactly my point.

2:00 PM

People just refuse to shut up and keep secrets secret. They want to brag and show off.

0

Q: HTML encoding to protect against XSS

While going through some references about protection against XSS i found that it is a good practice to encode data (entered by users) before using it to generate a dynamic page. I was not able to find out a detailed explanation of this statement.my question is How does encoding help prevent XSS...

attack-prevention xss encoding

It's not really saying anything non-obvious.

I think this could be a good candidate for a canonical answer on XSS. Unless we have one already.

Is there anything the existing answer is missing?

@TerryChia compare to my canonical XSS answer on Stack Overflow. (from the time before the land of sec.se.

46

A: Will HTML Encoding prevent all kinds of XSS attacks?

No. Putting aside the subject of allowing some tags (not really the point of the question), HtmlEncode simply does NOT cover all XSS attacks. For instance, consider server-generated client-side javascript - the server dynamically outputs htmlencoded values directly into the client-side javascri...

@TerryChia @Adnan's comment there is also a pointer in the right direction.

@AviD My comments are always point in the right direction.

2:05 PM

@Adnan Is that a double-entendre I'm sensing?

@RoryAlsop I'll probably write another QOTW post sometime this weekend. Most likely on this question.

21

Q: How to block or detect user setting up their own personal wifi AP in our LAN?

Recently, I found a user plug a USB Wifi stick on his desktop, and set up an AP without password. How can we detect or block this via firewall rules or other approach?

@TerryChia eeeeeeeeeeexcellent

now I am unemployed, I have no excuse, so I should do one as well

@TerryChia A QOT-what, now? ;-)

The Bear should work on a few, I see quite a few crypto ones in there. :)

@TerryChia canonical added. I'm lazy.

1

A: HTML encoding to protect against XSS

(Copied from my answer on StackOverflow ) No. HtmlEncode simply does NOT cover all XSS attacks. Encoding is the correct solution, but not always HTML encoding - you need context-sensitive encoding. For instance, consider server-generated client-side javascript - the server dynamically outputs ...

@AviD heh, saw that. that upvote is mine.

2:08 PM

RE Juice Jacking

8

Q: Protecting cellphones from USB attacks (a.k.a. Juice Jacking)

We have several smartphone with encrypted data on them (BES, iPhone, Android) and want to prevent an unauthorized person from downloading information from the device via USB. The visual assumption is that the USB file transfer mode is protected by a password; but then again, it is subject to i...

mobile exploit hardware corporate-policy phone

@TerryChia updated a bit....

Can't you also short the data pins in a USB cable to make it charge only?

@TerryChia Oui

If I'm recalling correctly and that's the case, one option would be to hand out charge-only cables to users who have phones with sensitive data.

No?

@Xander I think you can.

But the problem is that there isn't an easy way to distinguish charge-only cables.

So it's a user awareness/education problem all over again.

2:11 PM

@TerryChia Spray paint them green before you hand them out. :-)

@Xander I wouldn't like to explain to someone why only that cable can be used with his/her phone.

@Xander hmm, well USB 3 ports are usually blue....

Especially since the iphone and mini-usb cables are so common, there is always a risk that the user will just use a cable he/she has at home.

@TerryChia No need to explain: just glue the cable to the phone.

@ThomasPornin heh. that's another way to go...

I wouldn't want to explain to airport security why there is a cable permanently attached to my phone though....

2:16 PM

@AviD Yeah, actual color doesn't matter, just the concept. Explanation is an issue, but I think that telling them that their data could be stolen if they plug in public places with a standard cable is at least reasonable. It wouldn't stop them from using other cables of course, but I'd bet that most would comply most of the time.

@TerryChia so dont glue the whole cable, just an adapter / dongle.

@AviD Taht's only from disuse.

2:55 PM

Does the word dong pre-date dongle? 'Cause if it does, whomever coined the latter should be shot.

It looks like 'dong' has been in use as slang for 'penis' since about 1891. Dongle is much newer, and appears to have likely been derived from 'dangle'.

@ScottPack Is there not an etymological relation there? I assumed there was.

wordorigins.org/index.php/dongle

That's the best example I can actually find, but I don't know how authoritative that might be.

@ScottPack So, someone likely said to that guy "You know, that sounds a lot like a euphemism for a dick, right?" and he still decided to be one.

@Iszi It's cute when you assume malicious intent. :)

3:00 PM

@AviD I assume there is no connection to insects.... Dammit.

@ScottPack Given the individual likely had certain foreknowledge, it's not a difficult leap in logic.

@ScottPack according to that, it was intentional.

> The word is most likely a blend of dong and dangle, as it can resemble a penis that hangs off a computer.

Yeah, that's comforting.

So, all computers are female until they have software which requires a hardware device for licensing.

@AviD Which does not imply malicious.

@Iszi careful, @Adnan will start shoving his various devices in his computer.

Sometimes more than one at a time.

3:03 PM

@ScottPack Anyone who says "let me name this non-dick-related thing after my dick" is one.

@ScottPack no, it does not. Remember Hanlon's Razor.

@Iszi hey, he didnt' name it after his dick, specifically.

@AviD Great idea!

If he did, we'd be calling them Little Captains.

@AviD How do you know? o.0

Let's not forget the whole "male/female" end on connectors.

3:05 PM

@ScottPack well that just makes sense.

@Adnan Do remember that graphics card can reach toasty temperatures of 90 degrees.

Don't want you getting burned.

@TerryChia have you watched IT Crowd?

@Adnan Nope. And I have a feeling I don't want to.

@TerryChia Oh, yes you do. It's quite awesome.

@TerryChia It's actually a pretty funny series

3:07 PM

even considering the ridiculous accents.

Alright. It's on my to-watch list.

Scratch that, especially the ridiculous accents.

@AviD See, I was going to correct you. But I was busy eating. Glad to see you were able to realize it on your own.

Oh yes, speaking of having intercourse with a computer

@Adnan SFW?

3:10 PM

@TerryChia Do you work?

@Adnan No, but I'm thinking of the other people in here.

And it depends, in my work place it is.

and no I don't work in the porn industry

0

Q: Where do I securely store application-specific symmetric key?

I am writing an application App1. This application uses SQLite database and I plan to encrypt it using AES256. For symmetric encryption I need a key, which I need to store somewhere. From a similar questions I have a few options, but none is applicable in my case: Tie the encryption key to yo...

encryption windows key-management aes storage

Is it just me or is his objections impossible to meet?

@TerryChia You cannot protect a software-only system from a malicious admin

@TerryChia It's not just you, I too think same

3:18 PM

So you have to trust the OS at some point. A file with restricted read access is about as good as you can get, but relying on DPAPI will make auditors happier, some some reason.

@ThomasPornin Yeah, that's what I thought.

@ThomasPornin well, DPAPI in user mode, without recovery mode, does make it substantially harder for the maladmin. He can't just pop in to the file, he cant just take ownership, and even resetting the password would invalidate the user's access.

not that it cant be done - e.g. a rootkit keylogger would be the simplest - but it is not trivial, and most often would leave some traces.

@AviD It makes me think that we are just training attackers to be less lazy.

@ThomasPornin and there will always be a substantial segment that won't bother.

of course, this goes back to your threat model / risk profile.

and better human management.

@TerryChia It's just the usual DRM model "security"

as always, it's impossible

3:57 PM

@CodesInChaos Nothing is impossible, just improbable (or incredibly difficult). Except beating The Bear.

« first day (819 days earlier) ← previous day next day → last day (4082 days later) »

Transcript for

Mar '1314

The DMZ

A serious place where infosec is discussed PS we don't do hard...

404-errors moderate-anarchism pretending-to-work staring-into-the-abyss

join this room
about this room

00:00

06:00

12:00

18:00

all times are UTC

site design / logo © 2024 Stack Exchange Inc; legal

mobile