The DMZ - 2013-03-31

« first day (836 days earlier) ← previous day next day → last day (4036 days later) »

12:40 AM

22

A: What technical reasons are there to have low maximum password lengths?

Take five chimpanzees. Put them in a big cage. Suspend some bananas from the roof of the cage. Provide the chimpanzees with a stepladder. BUT also add a proximity detector to the bananas, so that when a chimp goes near the banana, water hoses are triggered and the whole cage is thoroughly soaked....

@ThomasPornin so what's the onomatopoeia for this one? :P

@ThomasPornin "Chugga-chugga-whoo-whoo"? :))) Anyway... Happy Easter!

1:39 AM

@TildalWave Not really. We went over to a friend's house to do an egg hunt this morning.

2:08 AM

0

Q: Recommendation for a book on Firewalls and VPNs?

Can anyone recommend a good book or books on firewalls \ vpn's. The book(s) would preferable not be vendor specific and should be geared towards entry\ intermediate level of experience. Thanks

firewalls vpn books

Seems to me to be a shopping question. It's on topic, but given that, is it a good question for the site, or no?

2:37 AM

@TildalWave Ahhh that's beautiful.

@Xander learning resources tend not to be treated as shopping questions, though limiting it to books seems a little odd.

@TildalWave I love that story, you rep-training whore.

Well, right reply, wrong person. @ThomasPornin....

5 hours later…

7:27 AM

@s4uadmin No, "correcthorsebatterystaple" is not safe because it is so wide-known and will probably exist in a dictionary attack. Also, tried using this password on DropBox? — Alvin Wong 4 hours ago

Really? Really?! You actually, and at least one other voted up, the idea that he suggested one literally use that password as written? @%^$#%$&

Some kind of special.

8:18 AM

@JeffFerland I refer you the last line of The Bear's answer.

@JeffFerland I don't think I've ever seen anyone recommend an actual password for someone else to use. Before today, I had never seen anyone assume that a password recommendation was a literal instruction to use this very password.

I does make me wonder how many people use correcthorsebatterystaple or correct horse battery staple as their password...

@Ladadadada *goes quickly to change his password*

8:41 AM

... and the winning answer of the thread:

-1

A: What technical reasons are there to have low maximum password lengths?

I love that all the answers are about DoS and hashing algorithms... the real answer is of course to prevent a Buffer Overflow.

9:37 AM

what the? a clean +100 on monkey and a banana story? right, i'm off to library to get some children stories you've never hear of!

@ScottPack oh that's nice :) it's a rainy day here, a true April come early one, so no egg hiding/hunting for us :(

@JeffFerland Wasn't me, as you later found out. But I did answer a few other questions in a similar way that not many cared to upvote due to... well, me not being a bear. This said, if you feel like dropping a +1 between my rep whoreish tits, I honestly won't mind :P :))

9:56 AM

I was wondering if we should make a question and answer on how to make a good report when penetration testing

10:10 AM

15

Q: What should a security audit report include?

Background I'm in charge of auditing a medium-scale web application. I have audited web applications several times before, but I've always wrote a short PDF quickly explaining what I encountered and usually I'm the one who's gonna be fixing those vulnerabilities so I never cared for the actual c...

yeeey

also this one from @JeffFerland:

10

Q: Should a pentest report include the tester's opinion?

In this particular case, the webserver turned out to be a shared 3rd party system and was not tested. Examples: We do express grave concern at the overall security posture of that webserver and the possible exposure to $client In general, it is our feeling that $client is a low-profile,...

penetration-test professional-education

@LucasKauffman Good morning! Too early to practice Google-Fu and Bing-Chi? :))

Sec.SE-Do

10:27 AM

@TildalWave google fu

2 hours later…

12:31 PM

@LucasKauffman That's how the Adnans do it, yeah!

Im still trying to make a nice template in Latex to make pentest reports

@LucasKauffman You're using latex for penetration testing reports? You realize how that sounds, right? :))

7

@TildalWave @LucasKauffman, that sounds awesome!

@Adnan Indeed. I wish it was acceptable to post pics of it too :)

Im still failing to make something better than what I have in word

12:37 PM

@TildalWave Haaaave you seen the pics posted here in The DMZ?

@LucasKauffman Heh, n00b.

(I actually have never touched Latex)

Latex is really nice if you understand it

@TildalWave Do you use Latex for penetration testing?

God damn it! After the Easter Sunday breakfast I'm too full and drunk to be here.

I use Word

but I want to make a latex template for autogeneration

61

Q: What technical reasons are there to have low maximum password lengths?

I have always wondered why so many websites have very firm restrictions on password length (exactly 8 characters, up to 8 characters, etc). These tend to be banks or other sites I actually care about security. I understand most people will pick short passwords like "password" and "123456" but ar...

passwords password-policy

Dammit I'm always asleep when reptrains occur. :(

1:33 PM

@Polynomial Ok, that makes sense.

2:08 PM

@TerryChia The real question, of course, is: would there have been a rep train if chimpanzees had not been involved ?

@ThomasPornin Maybe not to that extent, but probably yes. It's the type of question that is easily understood.

6 hours later…

7:47 PM

6

A: Why using random salts?

There is no point to the scheme you describe. The answer provided by Matrix isn't entirely correct as well. The only requirement of a salt is uniqueness. The easiest way to achieve this is through the use of a CSPRNG. However, being random is not a required property of a salt. However, do avoid...

@TerryChia Personally, I thought that question and the blog link he's been using deserve a whole lot more pounding :)

@TildalWave Someone just did a bit of that. security.stackexchange.com/a/33520/1472

@Ladadadada Heh nice :) I thought the bear will eat his heart out to remedy that, but that'll do also :)))

@Ladadadada Is there bcrypt or scrypt option for $algo? Just curious why thousands of iterations on PBKDF2 when there's slow KDFs available... I mean, if they are?

Is Corsair ram still worth buying?

8:02 PM

@ScottPack Why not? You mean from the price/performance point?

Or even quality. I just haven't had to buy ram in years.

I usually limit my choice to chip manufacturers more than based on whoever puts the sticker to the heatsink and packages it. Mostly try to go for Hynix or also Samsung last few years.

But I use Corsair quite a lot... maybe I'm sentimental, but I also don't have pleasant experience with a few others (namely OCZ and Crucial). Patriot is IMO a good choice in terms of price/performance and I have yet to see any fail on me.

At work we've generally gone Crucial. Good reliability and any returns have been pretty easy. It's also enough more expensive that for home I'm not sure it's worth while.

But hynix now rolls their own also... could be good deals

Easy returns are a lot more important when you're supporting around 10,000 computers. :)

8:10 PM

All Crucial modules I used are still 100% functioning... tried some ancient 133HMz SO DIMMs in a laptop a few months ago and they work no problems

bcrypt is available for PHP, although it's well hidden. You have to use crypt() (http://php.net/manual/en/function.crypt.php) and pass it a "salt" value in a particular format.

And they call it CRYPT_BLOWFISH rather than bcrypt just to confuse people even more.

@TildalWave Yeah, they seem pretty rock solid in general.

@Ladadadada ah no that's not confusing actually... b stands for blowfish anyway ;)

@TildalWave I have a stack of ram in the lab that I use when building snort boxes. Almost all that stuff is nearly 10 years old and still seems to work fine.

@TildalWave What would you call blowfish if you were to implement it in PHP, bearing in mind that the name "blowfish" is already taken?

8:15 PM

@TildalWave I did have a situation where I had a box that, of the 6 sticks, one would start failing only after running for at least a week or two.

@ScottPack the four modules in my current box were 3 times around the world (well, I exaggerate LOL), have been through airport scanners, changed boxes many times... I spilled some candle wax on them once, cleaned,... worked no problems. OCZ... used once, were advertising how great they handle heat... box with 5 12cm fans, 2 over modules... 1 blew apart completely, two showing damage, one still OK

@TildalWave It ended up taking me nearly two months to diagnose, but the ram never tested bad. Warranty replacement? Sure, no problem.

@Ladadadada well scrypt of course :)))

@TildalWave The 'S' stands for "Second blowfish". Obvious. :-)

@Ladadadada obvious :)) oh stop it i'm spilling my coffee here! lol

8:19 PM

I couldn't mind a blowfish.

@ScottPack Well you asked if Corsair is still worth buying. I think you're answering your question pretty good here ;) And for what it's worth, I agree. They're rock solid and quite competitive in price. Sure, you can buy cheaper... but...

@TildalWave I was extolling the virtues of Crucial.

@ScottPack they owe you some swag at least

Your example still gives the wrong impression. Any user input is harmful if it’s evaluated. — Gumbo 26 mins ago

Bloody hell, is my answer really that difficult to understand?

8:40 PM

@Gumbo - I find this to be a case of nitpicking now, really. What would you want me to add? All the possible XSS exploits for a code we don't have? I wanted to show this code from OP can carry a potentially malicious payload just as well as a URL that he's supposedly sanitizing with this code can. I believe I've managed to show that with, admittedly, speculative approach. Sadly, that's all we have to work on. If you have more information, then please don't hesitate to add your answer, but I'm done with mine. I don't feel there's anything left to say on the matter. — TildalWave 2 mins ago

too harsh?

@TildalWave Useless, maybe. People who have read the comments up to that point (including, e.g., your honourable contradictor), will either be already convinced, or unlikely to be convinced with an extra comment.

@ThomasPornin I'll take you word on this. I honestly have too much patience sometimes LOL. Someone shoot me :)

When conversation derails, I find it altogether more convenient to simply drop it and cease to respond. This is hardly polite, but on the Interweb being polite is considered offensive.

@ThomasPornin Yeah I have to stop having this need to reply to each question directed at me, you're absolutely correct. There are other questions that I could work on answers for in the mean time, probably a lot more deserving than someone that's nitpicking on non-relevant things. I shall learn, my padawan master :)

8:59 PM

Oh see me learn, there's a reply I shall ignore :)

9:13 PM

hello IT SECURITY!

user image

Herro!

9:38 PM

Herro ?!?

I love that episode

Following on from my comments about iPads, I have to admit the battery life is pretty good. Got this set up on Thursday and not had to recharge it yet, despite using it on the ingress intel map all day yesterday to help with our trek.

yeah they're pretty good on that front. I've concluded that there aren't any portals up here but I've been submitting some great ones if they get accepted

places that are 1.5 hours walk from the nearest road :)

and you need to have a specific network to have enough coverage to capture them :)

@rorym - have you requested membership of enlightened Scotland and enlightened Edinburgh g+ groups yet. All the tactical chat happens there.

Found a good one at lochwinnoch rspb centre - four of the resonators are in swampland :)

yeah I need to do the validation piece, I'm guessing you're a member (IIRC one of the options for validation was getting approved by another member...)

I can do that if you like. Want me to request they add you both?

9:49 PM

coolio ta :) yeah I'm my usual username raesene

hoping that some of the Livingston portals will come online soon, make it a bit more practicable to do stuff..

And Marion? Feel free to text if not wanting it here

Yeah - have submitted 14 between Robbin burns country and troon

cool yeah I'll need to look out her username....

will send it over..

10:01 PM

Rory - you are now approved for enlightened scotland

Apparently the mod has two of you :)

plus.google.com/communities/109143056804120563678

gents

Lucas

10:25 PM

@RoryAlsop Too bad I can't join.

Anyone got any suggestions as to why I was downvoted twice for saying 8 character password limits are not a good idea? I'm not quite sure if I said anything bad/wrong.

@AntonyVennard Coudl be the standard "No, there is never any reason." crew.

Guessing because of the implication in that comment that you had missed something? Dunno.

@scott - do you play there?

Hmmm ok. I just wondered if there was something obvious I said that was awful.

@RoryAlsop In Scotland? Not so much, no.

10:31 PM

@ScottPack Yep probably.

Heh. No, in 'merka

I'm trying to build myself to actually start attacking some of these foolish resistance cells.

We're....rather blue down here.

If you visit, we could give you a guest invite. Wish you could see the fun that happened this weekend

Much skullduggery

@RoryAlsop Oh, I did finally get my code, so I am playing.

And disguises and changing of cars etc

Yay

10:32 PM

Wait, wut?

Enlightened USA G+ group is public. Seems short sighted.

We had some visiting resistance level 8's so while they were attacking Edinburgh, our guys turned Glasgow green, then snuck up to the Wallace monument and demolished everything blue, and then got back to Edinburgh in time to destroy the attempted level 7 and 8 farms

I think joe Philly publishes the big projects after the fact

So the big Klue bit at the Wallace monument is now public

I still haven't really looked into all of the investigation stuff to figure out what that's about.

It seems suspiciously puzzle like. I don't much like care for puzzles.

Oh, we have an amazing group that find all the puzzles and clues in the media we pick up, and their answers give us stuff. Also the physical stuff, like a drop discovered in Kilmarnock today gives us XMP, res etc.

I can't solve these puzzles, like finding a frame at 1:34 in a video, that has morse code encoded into the lower bits, which when rearranged into trinary gives this solution code....

10:49 PM

221

A: What technical reasons are there to have low maximum password lengths?

Take five chimpanzees. Put them in a big cage. Suspend some bananas from the roof of the cage. Provide the chimpanzees with a stepladder. BUT also add a proximity detector to the bananas, so that when a chimp goes near the banana, water hoses are triggered and the whole cage is thoroughly soaked....

Too many variables

@tildal - I hadn't heard that story until Tuesday, when I read it in the book David from 22Bslash7 published

221 people would not have been told a bedtime story, if it weren't for @ThomasPornin ... that's including myself btw

And now here it is again

Worth a read. It's called 'I'll go home then, it's warm and has chairs'

Oh I've heard it before... but my inner voice when reading bear's texts sounds so warm and calming :)

Heh

221! Wow!

10:52 PM

yeah... I was complaining yesterday twice... when it had ~ 15 up votes I called it a rep train... then at 100 I was shocked... now, I'm gobsmacked

11:06 PM

-6

A: Shouldn't GPG key fetching use a secure connection?

In short: I could be tricked because it's not using HTTPS. because: HTTP could be "rewritten" on-the-fly (MITM) and from there, the attacker could give a false GPG server to me.

How do you call a sockpuppeteer playing with a sock big enough to fit in the whole person?

I realize that's old, but he removed accept from another answer, wrote a crap answer not explaining much anything from what others were saying, and then accepted his own answer

11:21 PM

That's new. Has anyone else seen this "Talk to an expert" javascript popup?

Hmmm... what's the date today again?

2

So you had a nice chat?

@TildalWave Got sidetracked looking at how random the string is in the transcript URL.

64

Q: What is "chat with an expert"?

A box just comes out of nowhere which says "chat with an expert". It happened once on Stack Overflow and once on Meta. Is this an ad? Isn't Meta supposed to have no ads? FYI, here's the code for that weird box: <div id="adviza-box" style="width: 380px; "> <div id="adviza-status"&...

support fun april-fools always-friday-in-iceland

11:48 PM

user image

« first day (836 days earlier) ← previous day next day → last day (4036 days later) »

Transcript for

Mar '1331

The DMZ

A serious place where infosec is discussed PS we don't do hard...

404-errors moderate-anarchism pretending-to-work staring-into-the-abyss

join this room
about this room

00:00

06:00

12:00

18:00

all times are UTC

site design / logo © 2024 Stack Exchange Inc; legal

mobile