The Bridge

Nate Kerkhofs

11:00 PM

8 character passwords are insecure and can be broken in seconds

all my passwords are at least 16 characters long

murgatroid99

@NateKerkhofs We're not talking about individual passwords. We're talking about password rules

Nate Kerkhofs

If you have an 8 character password and a 10 character password, the one with 10 characters takes longer to turn into plaintext

murgatroid99

If you allow more passwords, then someone trying to break any single password has to try more passwords

ArtOfCode

@murgatroid99 It mathematically doesn't.

Yuuki

@NateKerkhofs For 26 possible characters, the number of passwords of length between 8 and 16 is roughly 209 billion. The number of passwords of length between 4 and 16 is 9.5 x 10^16.

murgatroid99

11:02 PM

@ArtOfCode So, you're saying the set of passwords with 8 characters is empty?

Nate Kerkhofs

@Yuuki don't check a range of lengths, because people will use 8 character passwords if they can

Yuuki

By reducing the length of the required minimum, you have dramatically increased the set of all possible passwords.

Unionhawk

@NateKerkhofs Not necessarily

murgatroid99

@NateKerkhofs Obviously not, because you use a 16 character password

Nate Kerkhofs

I'm going to aska bout this on infosec.se

ArtOfCode

11:02 PM

@murgatroid99 Nope. I'm saying that mathematically, assuming no maximum limit, the set of passwords is of the same magnitude no matter the minimum.

murgatroid99

@ArtOfCode Oh, assuming infinite storage. I didn't know that was a reasonable assumption

Nate Kerkhofs

I'll link the question ASAP

Wipqozn

@murgatroid99 That's because it's not

Unionhawk

Thanks, Captain @Wipqozn

Tim Stone

@Unionhawk I don't see a scenario in which this isn't most likely, though

ArtOfCode

11:03 PM

@murgatroid99 It's not, at all, but if your hash algorithm accepts passwords of any length, it still only outputs 32/64 chars.

Unionhawk

I mean

Nate Kerkhofs

Your argument is fundamentally flawed btw: hackers are not going to go for a system that has 16 characters as the minimum, because it's just not feasible with current tech to break that hashing

Yuuki

@TimStone The one in which the general populace is actually somewhat knowledgeable about password security? That's unlikely as hell, but somewhat possible.

Unionhawk

If people want to use short passwords that's their prerogative

afaic

user15026

@GodEmperorDune I am still getting teh odd creepy KoL message. Less and less, but it amuses me now that I nkow what they're from. Surprised they're still going.

murgatroid99

11:05 PM

@ArtOfCode As long as you're salting (and I hope you are), that isn't really relevant

Nate Kerkhofs

but if your system allows 8 character passwords, you're going to have tons of people with low hanging fruit, who will see their credentials compromised

ArtOfCode

@murgatroid99 Salted, peppered, 1000-times iterated bcrypt hash in my systems :)

Tim Stone

@Yuuki Yeah, the "I don't see" was reality-based :P

Unionhawk

@NateKerkhofs As a user, this is not my problem

ArtOfCode

oh dear, here goes chat...

the main sites are down, chat's getting unstable

Tim Stone

11:06 PM

Also you broke chat. Decide among yourselves who "you" is.

Nate Kerkhofs

Unfortunately, security.stackexchange.com is not loading for me

murgatroid99

@NateKerkhofs yeah, same

user15026

@NateKerkhofs The network is having issues apparently.

ArtOfCode

@NateKerkhofs Network's fucked at the moment.

Unionhawk

We are investigating an issue with our Load Balancers

Tweeted by StackStatus on November 6, 2015 at 11:04 PM

Wipqozn

11:07 PM

NOO CHAT CNA'T CRASH

user15026

@Unionhawk Beat me to it.

Yuuki

@ArtOfCode If you're going to salt and pepper your dish that much, you might as well just eat straight out of the shakers.

ArtOfCode

@AshleyNunn two different ways of saying the same thing, in different degrees of diplomacy.

murgatroid99

@Yuuki I think it's the bcrypt that's iterated 1000 times, not the salt and pepper

StrixVaria

ANOTHER STEVE EPISODE?

Wipqozn

11:08 PM

wait a sec

StrixVaria

THIS LATE?

Yuuki

Also, why not soy sauce?

Unionhawk

I wish BTTV detected sub properly to stop the slow mode indicator

ArtOfCode

Many many chat timeouts...

Wipqozn

OH GOOD, CHAT IS BACK

Okay, SO

ArtOfCode

11:09 PM

@Yuuki Only one salt and one pepper D:

Wipqozn

Has anyone ever made a joke about @murgatroid99 being @PrivatePansys wife?

Because if not, I just did.

Unionhawk

Probably

Wipqozn

Also it's @RedTuberX!

Unionhawk

That's not how jokes work

murgatroid99

@Wipqozn I think that happened at about the same time as the original "PrivatePansy's wife" joke

Wipqozn

11:10 PM

@murgatroid99 Okay, good.

Nate Kerkhofs

blog.agilebits.com/2013/08/31/how-long-should-my-passwords-be

Tim Stone

Great, whoever broke the load balancers also broke my text messages

RedRiderX

@Wipqozn I come bearing chat?

Nate Kerkhofs

that's a blog post about password lengths

murgatroid99

@NateKerkhofs That's a different question

Wipqozn

11:10 PM

@NateKerkhofs Yeah, you seem to be missing the point @murgatroid99 making

Yuuki

@RedRiderX Oh my. @RedTuberX and @Wipqalot reappearing?

Unionhawk

Allowing more passwords forces a brute-force attacker to try more things

murgatroid99

Your password should be long. That does not necessarily imply that preventing people from using short passwords is better

Yuuki

All we need now is @OrigamiRobot and the Bridge-pocalypse will have truly begun.

Wipqozn

@murgatroid99 isn't saying an 8 character password is more secure than a 16 character one, but that a wider range of possible passwords is more secure than a smaller range.

user15026

11:11 PM

@Yuuki That's unlikely. :(

Unionhawk

By definition, the set containing 6 character or more passwords is larger than the set containing 10 character passwords, assuming reasonable upper limits for technical reasons

Yuuki

@AshleyNunn :(

Nate Kerkhofs

@Yuuki where do you get this number?

murgatroid99

@Unionhawk Assuming finite limits, even

Unionhawk

@murgatroid99 Yes

Nate Kerkhofs

11:12 PM

@Unionhawk I personally don't believe that 8-16 chars is only 209 billion, while 4-16 chars is 9.5 10^16

Yuuki

@NateKerkhofs I mathed it wrong.

Unionhawk

@NateKerkhofs Hold on.

Nate Kerkhofs

also, only lowercase is dumb dumb dumb

Unionhawk

8-16 just lowercase letters is 26^16-26^8=like 10^22

Nate Kerkhofs

most people are used to choosing from a range of 62 characters: upper, lower and digits

Wipqozn

11:13 PM

@NateKerkhofs A lot of companies use case insensitive passwords. Google is a good example.

murgatroid99

@Wipqozn that sounds incorrect

I'm nearly positive that's incorrect

Wipqozn

@murgatroid99 They may have changed it, but at least a few years ago google passwords weren't case sensitive.

Shocked me too

Unionhawk

I know Facebook does both the capslock and the noncapslocked version or something stupid like that

Wipqozn

battle.net is an example reddit.com/r/wow/comments/3hbqcl/…

Tim Stone

@Unionhawk It's technically larger, but depending on what we're concerned with it might not matter. An offline attack will enumerate over the additional smaller password space extremely quickly. I don't see any real benefit in allowing shorter passwords, unless maybe 2FA is mandatory.

Unionhawk

11:16 PM

Yeah, it's on the same order of magnitude

It's around 10^22 for both

Tim Stone

But 2FA of course has nothing to do with the offline attack, so

Unionhawk

Since I just threw the result into a log and called it a day

Nate Kerkhofs

For some reason I got logged out suddenly

Wipqozn

Nope, looks google is case sensitive, @murgatroid99. I must have been mixing them upw ith battle.net

Tim Stone

We're working on mitigating a SYN flood attack, will be back online as soon as possible.

Tweeted by StackStatus on November 6, 2015 at 11:14 PM

oooo

Nate Kerkhofs

11:17 PM

As if Stack Exchange deleted my entire session

Unionhawk

shouldiblamewipqozn.com

@Wipqozn I don't believe you

user58869

what does mai stai mean? reason i'm asking...

Nate Kerkhofs

Anyway, going from 8-16 to 4-16 characters has no meaningful impact on password variety and only hurts user security

Wipqozn

@Unionhawk reddit.com/r/wow/comments/3hbqcl/…

Unionhawk

Oh, I thought you said google is case insensitive

Learn to read, @Uni

GodEmperorDune

11:19 PM

@AshleyNunn i can send you another one if you like, lol

user15026

@GodEmperorDune lol so nice of you

Wipqozn

@Unionhawk I did, but corrected myself.

Mixed them uyp with blizzard

Tim Stone

@Unionhawk I mean, he did at first, so he's still wrong

OKAY, PANIC.

We are investigating an issue with our Load Balancers

Tweeted by StackStatus on November 6, 2015 at 11:04 PM

We're working on mitigating a SYN flood attack, will be back online as soon as possible.

Tweeted by StackStatus on November 6, 2015 at 11:14 PM

user15026

I am debating dropping the money to get the IotM

user58869

11:19 PM

stay longer doesn't make sense, it must be something like stay longer no?

Nate Kerkhofs

Also, unless you're being spearphished, hackers aren't going to just break your password. They're going to try and break everyone's password, and the ones with shorter passwords will go first

Wipqozn

@AshleyNunn I'm not sure what that is

Tim Stone

LET THEM BE THE BLOOD SACRIFICE

GodEmperorDune

@OKAY,PANIC. shouldiblamewipqozn.com

StrixVaria

3 new Overwatch characters revealed, all 3 of them look super fun.

user15026

11:20 PM

@Wipqozn The KoL item of the month

Nate Kerkhofs

so having a higher base password length increases security

fredley

@GodEmperorDune Wipqosyn

Wipqozn

who should sacrifice in the name of the all mighty Load Balancer?

@AshleyNunn Oh, that game

GodEmperorDune

@fredley yesss, well done

Nate Kerkhofs

I think we should sacrifice a tightrope walker

Unionhawk

11:21 PM

@Wipqozn I'm going to go with @GodEmperorDune

@GodEmperorDune the tribe has spoken

Lazers 2.0

0

Q: How do you name your Minecraft server?

I'm creating a server for my friends at school and me so we can link and have fun together. I already created the server and everything, but they can't link if my server doesn't have a name! How do I name it!?

minecraft

Wipqozn

18

Q: Why do some bank websites use passwords that are not case sensitive?

It was recently brought to my attention that a certain big bank website allows users to log in with passwords that are not case sensitive. After confirming this, I checked other websites I bank with and found a second big bank website that does the same thing. I did not check their mobile clients...

passwords password-policy banks

user58869

Denisa, Nicolae Guta si Susanu - Hai sa impartim viata jumi juma (Videoclip Official ) HIT 2014

►

GodEmperorDune

@Unionhawk isuniwrong.com

@Unionhawk 10/10, would lol again

Wipqozn

Who is buying up all these domain names?

Unionhawk

11:22 PM

22 hours ago, by Unionhawk

user58869

apparently jumatate means half past

GodEmperorDune

22 hours ago, by GodEmperorDune

@Unionhawk i feel this is appropriate now

Nate Kerkhofs

There you go

8

Q: Doesn't imposing a minimum password length make the password weaker by reducing the number of possible combinations?

I thought the strength of a password depended on the total number of possible combinations. Therefore, allowing longer passwords should be safer because you then have more possibilities. But why do some systems set a minimum number? Doesn't this simply reduce the number of possible combinations?

passwords password-policy

GodEmperorDune

cc @fredley

Unionhawk

@Wipqozn I think @fredley has wipqozn, I know @TimStone has caching, and I don't know who has uni

Wipqozn

11:23 PM

@Unionhawk wait

Nate Kerkhofs

That's what we were discussing, right?

Wipqozn

@TimStone owns should i blame caching?

That just vlew my mind

user15026

@Unionhawk Yeah, I'm still not sure who has uni

Wipqozn

It's like I know a celebrity.

Unionhawk

@Wipqozn Almost 100%

Tim Stone

11:23 PM

@Wipqozn Yep

GodEmperorDune

@Unionhawk results might be wrong due to caching

Wipqozn

@TimStone I'll need to brag to me RL friends about tihs

GodEmperorDune

@Wipqozn about shouldiblamewipqozn.com

user58869

noi doi amandoi

Unionhawk

KK Slider meets Toby Fox

GodEmperorDune

11:27 PM

@AshleyNunn i sent you a one day ticket so you can check it out. they're pricey, so i would spend all your turns there

user58869

sunt bine

Tim Stone

@Wipqozn It's always fun to see it used elsewhere, I didn't want to put analytics on it since that seemed unnecessarily intrusive.

user58869

what does "ba da" mean?

r3tr0 t3h PeNgU1N oF d00m

hehe

so random

:3

StrixVaria

@Alice Your track record is posting nonsense that no one cares about. You're not doing yourself any favors by posting nonsense in Romanian.

2

Unionhawk

11:28 PM

Goddammit @r3tr0t3hPeNgU1NoFd00m why is your name annoying now

OKAY, PANIC.

We're running behind @CloudFlare now - let us know where you are if you're not seeing the sites back up!

Tweeted by StackStatus on November 6, 2015 at 11:23 PM

user58869

@StrixVaria hey stranger, i thought you woz ignoring me

r3tr0 t3h PeNgU1N oF d00m

@Unionhawk At least you know who I am when you see my name. :3 hehe

StrixVaria

@Alice I'm a mod. If you are irritating enough that I'd put you on ignore, I ban you instead.

10

user58869

fear

StrixVaria

11:29 PM

Really, though, as a rule I don't ignore people. That way I can see when people are being disruptive.

r3tr0 t3h PeNgU1N oF d00m

@AshleyNunn For IOTM, I can provide some recommended ones

Don't bother getting the current Nov IOTM

StrixVaria

I do believe this is the second time I've mentioned you posting stuff in Romanian that no one else responded to or even acknowledged. I'd prefer not to see it again.

r3tr0 t3h PeNgU1N oF d00m

some of the best IOTMs don't have competition at all and are extremely helpful no matter what kind of run you do

Arperum

@Unionhawk At least it has "retro" in it. Sortoff anyway.

r3tr0 t3h PeNgU1N oF d00m

Like Chateau of Magenta key, or Lovebug Pheromones

Unionhawk

11:31 PM

@Arperum I mean, it's not like it's hard to identify ever anyway

r3tr0 t3h PeNgU1N oF d00m

I would highly suggest buying a Mr. Accessory, selling it in the Mall for meat, and then using said meat to purchase a better iOTM

Unionhawk

Like, it's not some grand puzzle to begin with

StrixVaria

@Unionhawk It's easy to figure out, if you think to look. It's that latter part that catches you.

Arperum

@Unionhawk I didn't even notice there were two ignored users instead of one.

GodEmperorDune

@r3tr0t3hPeNgU1NoFd00m i didn't know you still played kol

user58869

11:32 PM

i have no idea what i did wrong, but it seems i did it again

r3tr0 t3h PeNgU1N oF d00m

For example, the Chateau key can get you either 3 potions every day, 3k meat every day, or some stationary

Unionhawk

@StrixVaria I always think to look

r3tr0 t3h PeNgU1N oF d00m

And you can boost stats by incredible amounts since you can simply rest to boost your moxie stats. @GodEmperorDune Only occasionally but a little bit more active now that I struggle playing modern FPS games with a 1gb ram machine

user58869

Britney Spears - Oops!...I Did It Again (Official Video)

►

Unionhawk

@Alice Nobody in here speaks romanian. Asking what things mean is probably nonproductive, no?

Nate Kerkhofs

11:33 PM

What's KoL?

Arperum

@NateKerkhofs Kingdom of Loathing.

StrixVaria

@Alice IMMEDIATELY after my post about posting nonsense, are you kidding?

Nate Kerkhofs

oh, right, Kingdom of Loathing

r3tr0 t3h PeNgU1N oF d00m

Kingdom of Loathing, great web game, check it out

user58869

@Unionhawk hmmm, your hung up on my attempts at romanian?

r3tr0 t3h PeNgU1N oF d00m

11:33 PM

ages old too as well

kingdomofloathing.com

StrixVaria

@Alice Join in the conversation, participate as a human and not a Romanian learner/link machine.

user58869

i am trying to learn to speak romanian, it's not easy

StrixVaria

@Alice This is not the place.

Nate Kerkhofs

@r3tr0t3hPeNgU1NoFd00m I tried it a few months ago, I think. That's the game that looks like it's drawn by a toddler, right?

user58869

@StrixVaria are you talking to me or someone else?

r3tr0 t3h PeNgU1N oF d00m

11:34 PM

@NateKerkhofs Stick figures and stuff, but the humor is totally spot on

StrixVaria

@Alice Is there anyone else named @Alice here?

GodEmperorDune

@NateKerkhofs the pop culture references are great

for example, a quest with a bridge troll spouts crap about gamergate

user58869

@StrixVaria i do not know. but i know that i have only tried to speak in romanian once here, and you are reprimanding me for it again

StrixVaria

@Alice "only tried...once" "reprimanded again"

Try again.

r3tr0 t3h PeNgU1N oF d00m

@Alice Stop playing dumb and trying to perpetuate the argument. You're only digging a hole deeper for yourself. Just listen to Strix, that's all you need to do.

user58869

11:36 PM

whatevs

Nate Kerkhofs

Yeah, I can tolerate bad graphics up to a point. this game is about 99% short of that point

ArtOfCode

Simple: stop, or Mjölnir gets to play.

Arperum

@NateKerkhofs It's mostly text based anyway, the graphics are not the important part.

r3tr0 t3h PeNgU1N oF d00m

> Playing kOl for graphics

user15026

@r3tr0t3hPeNgU1NoFd00m Yeah, but if I want to get old IotMs, that means saving a lot of Meat and buying them from someone in the mall, yes?

GodEmperorDune

11:37 PM

looks like we have a jewelry store with all these diamonds on display

3

r3tr0 t3h PeNgU1N oF d00m

@AshleyNunn Yeah. You can also get some IOTMs that are great for farming meat

like Airplane Charter Dinseyland

GodEmperorDune

@AshleyNunn correct

Nate Kerkhofs

I'm off to bed

StrixVaria

@r3tr0t3hPeNgU1NoFd00m As much as I'd love that to be the rule, I would also love him to actually give any indication that he comprehends the problem at all.

r3tr0 t3h PeNgU1N oF d00m

But most people I know prefer the easy way of buying Mr. Accessories, selling them for 30 miL? on the market?

GodEmperorDune

11:38 PM

@r3tr0t3hPeNgU1NoFd00m closer to 22 mil last i checked

Arperum

@AshleyNunn Yes. But you can buy Mr A's with real money and then sell those in the mall for a nice pile opf meat (like 22-25 million meat or something)

r3tr0 t3h PeNgU1N oF d00m

Let me check the mall prices right now

user15026

@r3tr0t3hPeNgU1NoFd00m Ah, I don't have nearly enough money :(

r3tr0 t3h PeNgU1N oF d00m

Oh, you said you were going to buy an iOTM soon? I would also suggest reddit.com/r/kol , definitely go around there; community's very friendly and helpful

StrixVaria

BobRoss jumped to 90k viewers during the last episode now.

Unionhawk

11:39 PM

Might hit 100k

r3tr0 t3h PeNgU1N oF d00m

@Ashley Disregard my previous statement. Looks like Chateau is so popular it's doubled in Mr. Accessory price

Unionhawk

(I see 96)

r3tr0 t3h PeNgU1N oF d00m

Chateau keys are 46mil meat while mr. accessories sell for 23mil

StrixVaria

@Unionhawk It's growing fast still.

r3tr0 t3h PeNgU1N oF d00m

@AshleyNunn In fact, why don't you tell me your in-game name, or you can pm me ingame, username is Retrosaur

I have some spare stuff if you need any of it

Unionhawk

11:42 PM

Yep, that's 100

Wipqozn

@TimStone I post it at work all the time

r3tr0 t3h PeNgU1N oF d00m

So yeah, just hit up reddit.com/r/kol

user15026

@r3tr0t3hPeNgU1NoFd00m I'm Araleith

StrixVaria

@Unionhawk Wow 7k since I looked.

r3tr0 t3h PeNgU1N oF d00m

reddit.com/r/kol/comments/3eowbe/…

Unionhawk

11:44 PM

It jumped suddenly

ArtOfCode

@AshleyNunn Cool name.

Unionhawk

Bob Ross currently has more viewers than BLOPS3

r3tr0 t3h PeNgU1N oF d00m

I did not know this many Arqadians play KoL, holy moly.

user15026

@r3tr0t3hPeNgU1NoFd00m Yeah, a bunch of us do. :)

Unionhawk

At this rate Bob may overtake hearthstone

But there's not much time

Newly Opened Proposals for Entertainment

11:49 PM

1

Men @ 40

Proposed Q&A site for a site for men in their 40s. Life changes as we level up (progress, getting older) and there are a few questions swimming in our heads. Ok more than a few. Life's questions, suggestions and comments at 40.

Currently in definition.

1

Negotiation

Proposed Q&A site for people involved in deal-making across a variety of professions

Currently in definition.

1

Angular

Proposed Q&A site for angularians and those who have specific questions regarding angular 1.x, 2.x and beyond.

Currently in definition.

1

Computing history

Proposed Q&A site for this site is for people who are curious about computer / technology companies history and their products.

Currently in definition.

1

Jivox IQ

Proposed Q&A site for users of the Jivox IQ platform. Jivox IQ is a data-driven, cross-screen ad production and serving platform for rich media, video and mobile ads, with capability for real-time monitoring and updates.

Currently in definition.

Lazers 2.0

0

Q: How do splitting rounds work?

After buying splitting rounds, I'd expect to see three projectiles from my gun and three bullet holes in the wall... but I still see just one. Do the rounds split after they're shot? If so, how far away from the shark do I need to be to ensure my bullets are splitting? Do they split horizontal...