The DMZ

4:11 AM

@Iszi Just for the benefit of chatters: A salt is a defensive response to rainbow table and similar attacks. It adds a hopefully unique piece of data to the key/password/passphrase that changes the hashed/encrypted value so that a precomputation of keys/passwords/passphrases is made impotent as it will not have included the salt value. Similarly any cryptovariable when compromised on one system will have a different cyphertext value on another system if the salt value is different.

3

And for the lazy, just in case I become one.

this.josh

4:35 AM

@ScottPack rxvt-native shares copy/paste buffer with Windows

Sep 1 at 18:16, by Scott Pack

@Iszi That usually only happens to me when browsing porn sites.

Iszi

4:55 AM

@thisjosh So, a compromised salt+hash just makes cracking the password extra-difficult, as opposed to a compromised hash but secure salt which should make cracking the password nigh-impossible - am I correct?

this.josh

Not quite. The salt is never protected.

Protecting the salt to add extra burden to the defender at no additional cost to the attacker.

Iszi

@thisjosh I would think protecting the salt would make things very difficult for the attacker. But now that I re-consider it, it would be a horrid inconvenience to the defender as well.

this.josh

The salt just makes precomputation harder by making the effective cyphertext longer or by requiring the aquisition of the ciphertext database before table generation.

@Iszi Exactly. It is good practice to not overdo defensive strategies and risk the wrath of the unintended consequences beast.

2

Iszi

In other news, I'm watching a Top Gear episode featuring the Marauder. I think I want one!

Marauder (vehicle)

The Marauder is an armoured, mine-protected vehicle that is produced by the Paramount Group in South Africa. It was launched during the 2007 International Defence Exhibition (IDEX) and Conference in Abu Dhabi, the largest arms exhibition in the Middle East. Mobility With a curb weight of and a payload weight of , the Marauder was developed for reconnaissance and peacekeeping missions. It is able to carry a crew of ten, including a driver and commander. The vehicle was originally designed to operate in urban settings, and built-up and confined areas. As such, it is smaller in both siz...

this.josh

And around here we're (loosly stated) rooting for the defender.

Iszi

5:03 AM

Apparently, there's a civilian version of that.

this.josh

I'm guessing there arn't a lot of mechanics who service that...

Iszi

@thisjosh Or towing companies... as the show just demonstrated.

(They made a play of towing the Marauder for improper parking, and instead the Marauder hauled the tow truck away.)

this.josh

If it can't tow itself what good is it?

Personally I believe the most classified vehicles are the military tow trucks.

Iszi

Oh, I love this bit. I.E.D. survival comparison of the H3 vs. the Marauder.

Stack Exchange

Iszi

5:10 AM

Of course, it just reminds me of...

►

this.josh

I lack flash player

I have a browser around here somewhere with it.

AviD

gmorning sec'se.s

@Iszi tend to run into a lot mines, in your neighborhood?

@Iszi really taking the wardriving to the next level! Booya!

@thisjosh luv that statement!

this.josh

I fear the unintended consequences beast, I think it's stalking me.

3

AviD

@Iszi this is worth emphasizing: the salt's purpose is one - to prevent precomputation via uniqueness. the issue with ostensibly "longer passwords" is not in play here - rainbow tables and the like don't care (in principle) if you added a few extra bytes, the password will be retrieved.

@thisjosh heh

@AviD that is assuming, of course, that a big enough table was built, for len(password) + len(salt)

once you have that, "guessing" which chars are from the password, and which from the salt, is negligible.

this.josh

I tried ignoring it once and a prototype became a product overnight.

2

AviD

5:23 AM

hehe, you're on a roll today!

had to star 3 of yours in a row...

this.josh

Damn, I also fear exposure.

I wasn't paying attention, didn't notice the stars.

AviD

@thisjosh dont know about most, but yes, there is/was a classified vehicle, which also served as a tow truck.

had a common base model, and the top could be either tow truck / crane / gasoline truck / ammunition carrier / etc. but the base model was a heavy wheeled (almost) all-terrain vehicle...

this.josh

@AviD Lets put it this way, you see tanks and personel carriers all the time, but you never see critical support vehicles like vehicle refuling, towing, and on-site repair. Logically you must know they exist. If a idiot tank driver gets his tank stuck how long can they afford to leave it there?

There must be a vehicle capable of towing tanks, but I have never seen one.

AviD

@thisjosh :$ well, my military unit is stocked chock full of support vehicles....

@thisjosh same truck....

though most often they just use another tank for it.

this.josh

Yes, seems likly as it must fit a lot of the same requirements.

AviD

5:32 AM

@thisjosh yes, I've even witnessed it tow itself.... (via pulling in a cable wrapped around a steel girder.... ) (okay, not by a lot...)

this.josh

@AviD Really, I would have thought that the cost was too high to make a standard tank a tow tank as well. Risk the asset and the personel and position instead of substituting a lower cost solution

AviD

@thisjosh as you said, how long can you wait? sometimes, you'se gots to do whats you'se gots to do.

'course, I'm talking about the Israeli army, where the emphasis is on getting sh** done... US army might be different ;)

this.josh

Of course. sometimes you abandon the asset and see what happens

AviD

@thisjosh it also depends on scenario: training maneuvers, wartime, underfire, transportation, etc etc...

this.josh

Humm how to respond here...

AviD

5:35 AM

heheh

no political comments necessary!

this.josh

Good point, sometimes no response is the best response.

AviD

@thisjosh I was just talking about how israelis dont like to follow rulebooks. Definitely not making any political statements.

this.josh

That contradicts almost every other operating military.

AviD

oh dont get me wrong, we have a rulebook. We just dont like to use it (when it doesnt fit...)

do you know what the difference between theory and reality is?

this.josh

Life and death

AviD

5:38 AM

In theory, there is no difference.
In reality - there is.

this.josh

In theory you're alive, in battle...

AviD

@thisjosh ah no, didnt mean anything as existential as that...

And, on that uplifting note, I will have to bid you all, Good day.

(wonder how many mod votes I just lost for that occupationistical rant...? :D )

this.josh

Can you track the voting?

Rory Alsop

8:22 AM

@thisjosh Heh - no, mods don't get that sort of info. We get told how many people have looked at the election page, how many are eligible to vote, and how many have voted, but that's it

M'vy

8:33 AM

@RoryAlsop You need the next rank to see more : Dark Lord of the Sith

Rory Alsop

8:50 AM

@Mvy maybe so:-) need another 6k rep to reach 20k (isn't that Dark Lord of the Sith level?)

Rory Alsop

10:12 AM

Thanks to the folks who flagged today's spammer - their account has been deleted

Transcript for