Root Access

Bob

4:04 PM

@Hennes rust => corrode

Hennes

Yup. that would be better

allquixotic

DMZ is unresponsive, so here: shamelessly cross-posting

Can anyone tell me if the Apache Struts Taglib "token" functionality (where your HTTP response contains a unique, cryptographically-secure token that the client has to spit back to you in the HTTP POST of a form) is a security function that prevents CSRF? if so, is it necessary or sufficient for preventing CSRF?

I found a CSRF vuln in our app (during the testing phase, thank god, before production implementation) and the developers deployed a fix by adding those taglib tokens into all the forms; you can't submit an HTTP GET or even a POST of the form using javascript on the user's behalf without running some native code because Same Origin Policy prevents your script from viewing what's in the child iframe from another domain

seems like the token is acting as a defense mechanism against CSRF but wanted to be sure

I take that back: you can submit a POST or GET of the form all you want; but the app just kicks back a vague error page and refuses to process anything in your request because you didn't supply the (correct) token

HWND WINAPI CreateWindowEx(
  _In_      DWORD dwExStyle,
  _In_opt_  LPCTSTR lpClassName,
  _In_opt_  LPCTSTR lpWindowName,
  _In_      DWORD dwStyle,
  _In_      int x,
  _In_      int y,
  _In_      int nWidth,
  _In_      int nHeight,
  _In_opt_  HWND hWndParent,
  _In_opt_  HMENU hMenu,
  _In_opt_  HINSTANCE hInstance,
  _In_opt_  LPVOID lpParam
);

@Bob, enjoy

Bob

ok, another advantage of AddClipboardFormatListener: I don't need to bother with disposing off/removing the listener when closing the program (I think/hope)

@allquixotic D:

actually, that's not that bad

allquixotic

which API has the most arguments?

Bob

I don't want to know.

hm

@allquixotic can you suggest an icon for the notification area? :P

allquixotic

4:23 PM

@Bob How about a low-res, close-up picture of a white fru-fru dog who looks like he's about to bark?

After all, fru-fru dogs are a part of SU/RA culture.

Bob

hm..

@allquixotic SU/RA?

allquixotic

@Bob SuperUser / Root Access

Ruuuuuun! A programmer is up in hurr! /me points at @NullUserException

hisses and puffs up to twice his normal size

Bob

hwha

and since when did you suggest a dog?

you're our resident cat-guy

allquixotic

@Bob True, but the dog meme is more well-known.

It's just me and HackToHell who like cats. The rest of the Cool Kids have dog gravatars.

Bob

guess I'm not a 'Cool Kid' then :P

allquixotic

4:28 PM

Well, except Tom. I don't think I want to claim that Taylor Swift is a type of dog.

@Bob a fox is a dog! of a sort.

There was a superstition during the Win8Challenge that pictures of small dogs were somehow psychologically leading users to upvote the posts of users who employ said dogs as gravatars.

Bob

@allquixotic Vulpini, not canis...

allquixotic

And accept them as answers, too.

Bob

@allquixotic ah, I believe that may have been my fault :P

allquixotic

@Bob Oh, good point.

Fine! You're not a Cool Kid, either, then.

Bob

:P

allquixotic

4:32 PM

If you insist on arguing that you aren't, I won't stop you.

@Bob THAT is the fru fru dog I was thinking of.

Bob

Bichon Frise

A Bichon Frisé ( or ; French, meaning curly lap dog), is a small breed of dog of the Bichon type. They are popular pets, similar in appearance to but larger than the Maltese. Etymology and history The Bichon Frise descended from the Barbet or Water Spaniel and the Standard Poodle. The word bichon comes from Middle French bichon ("small long-haired dog"), a diminutive of Old French biche ("bitch, female dog"), from Old English bicce ("bitch, female dog"), related to Old Norse bikkja ("female dog") and German Betze ("female dog"). Some speculate the origin of bichon to be the result ...

allquixotic

they kind of remind me - vaguely - of the icanhascheezburger cat, because in many pictures of both those dogs and the cheezburger cat, you can see their bottom front teeth.

Bob

yay, clipboard notification works

allquixotic

yay!

Bob

oh boy

> The runtime has encountered a fatal error. The address of the error was at 0x6bff6b10, on thread 0x2b24. The error code is 0xc0000005. This error may be a bug in the CLR or in the unsafe or non-verifiable portions of user code. Common sources of this bug include user marshaling errors for COM-interop or PInvoke, which may corrupt the stack.

allquixotic

4:37 PM

@Bob make sure you're running the debug version of the CLI (with debugging information in the natives) and trap the native exception and see if you can isolate the problem

should at least be able to get a native function call stack trace

your other alternative is to set a breakpoint before and after every native function call in your program (or libraries you're using) and see which one crashes, but that's more tedious

Bob

interesting

hm

this only happens when copying from MS Word

copying from FF is fine

allquixotic

Word is extremely odd about how it uses the clipboard

Bob

..

wut.

allquixotic

Microsoft Office programs in general (Outlook, Word, etc) use an extension/overloading of the default Windows Clipboard called the Office Clipboard

Bob

Fun stack trace.

OutOfMemoryException

O.O

allquixotic

4:39 PM

O_O

Sathya

howdy folks

allquixotic

what's your max heap size? hi @sathya

Sathya

superuser.com/review/suggested-edits/62702

Bob

ah.

allquixotic

Word can put many megabytes of data on the clipboard because of all the formatting etc it captures

Bob

4:40 PM

wait for clipboard modification, change clipboard, repeat.

a fun little loop.

allquixotic

infinite loop? :D

Stack Exchange

0

Q: Why can we only edit our comments for the first five minutes after posting?

I sometimes come across comments that I have typed quickly or on a mobile device or simply without paying enough attention and they have spelling mistakes or typos. Since I can only edit my comments for the first 5mins after posting, I cannot correct such errors when I see them and they are extre...

allquixotic

catching events from your own program? :D

Bob

@allquixotic funfunfun recursion

wwell, not really

I think SetData returns immediately

@allquixotic I believe it usually uses delayed rendering

hence the 'do you wish to keep using the data on the clipboard' message when you close it

@Sathya someone's learning markdown! :D

allquixotic

jsut fiY yuo cna aslo delet yuor unstighly coments. — allquixotic 30 secs ago

Sathya

4:43 PM

hehe

Bob

oh wait, the button inserts Blockquote automatically. meh.

ok, how the heck do I stop this infinite loop?

oh, I know! hash the image, store that, check it.. I guess.. actually, I don't know.

allquixotic

@Bob that'd work

in the general case of where you have a getter and a setter for some data, and an event callback wired up to the setter, and your callback calls the setter, you need some way to determine whether your callback is being called as a result of your callback calling the setter

the easiest way to do that is to perform an equality check or hash check on the data

Bob

@allquixotic nope

allquixotic

it'd be more elegant if you could call a setter that doesn't trigger the event

Bob

@allquixotic I guess I could check if the window handle that added the data to the clipboard is my own, but I don't exactly want to upload duplicate data

@allquixotic eh, not possible here

unless there's something buried deep in the Windows API

but not much point in letting programs hide their clipboard changes

hm.. I know one clipboard monitor program explicitly adds a custom data type to alert other monitors to ignore it

NullUserException

5:00 PM

@allquixotic LOL

allquixotic

@NullUserException Don't worry; we're not really hostile to programmers in here. I am one. It's just a bit unusual, because most people who have a lot of rep at SO are smart enough to not need to come to SU with their problems. Just a trend. But of course you are welcome ;-)

I'm a (bad/mediocre) programmer who's better at tinkering, troubleshooting, and validation than I am at writing copious amounts of well-architected, efficient code.

NullUserException

@allquixotic If it makes you feel any better I haven't written copious amounts of well-architected, efficient code either

Sathya

welcome back to RA, @Null

allquixotic

Could've fooled me ;) If I were a hiring manager and you were interviewing, I'd probably hire you from your SO rep alone. :D

NullUserException

@allquixotic It's not in my job description

I honestly don't know if I could be a code monkey type

allquixotic

5:04 PM

Nor is it in mine, but I do get "requests" from time to time.

NullUserException

@Sathya HI

@Sathya Do you have mod access to all SE chat rooms, too?

Sathya

@NullUserException yep.

but not Stack Overflow ones

Bob

O.O

0

Q: PC loading programs slower than normal after voltage change

I always turned on my PC at 220V, it always worked normally. Today I turned my PC at 110V and it was very slow to load any program. I turned it back on at 220V but it is still very low to load anything. Changing the voltage could have changed some configuration on my PC? What could have happened...

performance voltage

don't tell me this guy has one of the older PSUs (non-SMPS) with a voltage switch... and he switched it to lower-than-input voltage?

if so, I would've expected smoke...

how.. how did it even work?

allquixotic

@Bob I always turned my 747 at 10 degree bank, and it always worked normally. Today I turned my 747 at 80 degree bank and it was very slow to respond to any controls. I turned it back to 10 degree bank and it is still very slow to respond to controls. Banking too much could have changed some configuration on my ailerons? What could have happened...

Hennes

He needs top recapture that magic smoke. This is best done by applying an unicorn horn to the PSU

NullUserException

5:16 PM

@allquixotic How's Win8? Would you recommend it to someone who doesn't have a touchscreen?

allquixotic

@NullUserException I have a very strong viewpoint on this. My overall opinion is that Windows 8 with the "Start8" application installed and certain configuration options is perfect for a non-touchscreen, keyboard/mouse configuration, but you need to be willing to live without Modern UI, or at least, very rarely use it.

NullUserException

@allquixotic What do you mean by "Modern UI"? "Modern" from a looks or functionality perspective?

allquixotic

I split it out into three cases. Case 1: Touchscreen and kbd/mouse. Result 1: Go for it; perfect setup. Case 2: Touchscreen; NO kbd/mouse. Result 2: Use Modern UI as much as you can, and avoid the desktop. Case 3: No touchscreen; kbd/mouse. Result 3: Use Start8 to avoid Metro as much as possible; set group policy to open URLs in desktop IE; and use the desktop whenever possible. It's Windows 7 with better drivers and Client Hyper-V!

Modern UI is the name of the "Metro" UI. The name Metro was discontinued but it refers to the same thing

Windows 8 essentially has two entirely separate desktop environments installed alongside one another: the traditional XP/Vista/7 "desktop mode", and the brand-new, touchscreen-biased "Modern UI"

the Start Screen which appears in Windows 8 out of the box is basically the launching-off point for starting Modern UI apps, but the Start8 application from Stardock all but disables Modern UI. It doesn't disable it strictly speaking, but it makes it easy to use desktop mode without having Modern UI pop up in your face.

Bob

@allquixotic eh, I've found that, with the correct drivers, a touchpad with gestures can be a reasonable substitute for a touchscreen in MUI

well, it's a lot smoother than a mouse

allquixotic

for example, with Start8, a Windows7-esque start menu is resurrected, and instead of booting up into the Start Screen, it boots up into the desktop.

@Bob perhaps, but I'm talking about a mouse

Bob

5:21 PM

@allquixotic but you never addressed touchpads! :P

NullUserException

@allquixotic So essentially it would be like using Windows 7 with a boxier looking UI?

allquixotic

@Bob I've never used a touchpad with good enough drivers to make it even a semi-replacement for a touchscreen

Bob

@allquixotic not for a replacement, per se, but the gestures help with the little things

allquixotic

@NullUserException if by "boxier" you mean that they replaced Aero with a different window theme, then yes, but Stardock (again I recommend one of their products!) should be coming out with WindowBlinds 8 soon, which will allow you to customize the window decorations.

Bob

showing charms bar, showing the app bar thing, scrolling..

allquixotic

5:23 PM

@Bob having to use the charms bar at all (or the app bar thing) is a misfeature if you don't have a touchscreen, IMHO... which is why Start8 disables it

you can also disable the hot corners that pop up the start screen by moving your mouse into a corner; that way you can actually use your entire screen for mousing without triggering unwanted features

Bob

@allquixotic does it disable the new wlan selection dialog?

cause that's the buggiest piece of crap I've encountered so far

allquixotic

@NullUserException the other part of it is, if you look past the UI, Windows 8 does have significantly improved drivers, better performance, IE 10 (which is worlds better than IE 9), DirectX 11.1, and WDDM 1.2

Bob

crashed at least twice while setting up three methods

allquixotic

@Bob I don't know! I've never used wifi on Windows 8 at all

Hennes

But IE 10 still does not allow you to use proper add-ins

NullUserException

5:25 PM

@allquixotic I don't care too much about the UI (hell, I'm a programmer) and I don't use IE anyways (Chrome all the way)

allquixotic

what do you mean by "proper"?

Hennes

Meaning until ms changes its design IE is never going to get recommended over $other_browser plus flashblock, add block etc etc

E.g. allowing greasemonking, or other scripts to grab the html input and cleaning it

Bob

@Hennes wasn't there an AdBlock for IE?

allquixotic

@Hennes there are viable adblocking extensions for IE

Hennes

Which, as I understand it, is blocked per design in IE

Bob

5:26 PM

ditto for userscripts

NullUserException

@allquixotic Though I'd like to know, how can you say it has "improved drivers"? Performance isn't a huge issue for me; I have a pretty beefy computer and it can handle anything I throw at it

allquixotic

@NullUserException well then, if the additional "under the hood" features aren't enough to entice you, then indeed there is no reason to upgrade to Windows 8... without Start8, it's a frustrating experience with a mouse. With Start8, you can eliminate the usability regressions and basically return to how it was with Win7.

@NullUserException well, to start with, all of the new graphics drivers for Win8 from Intel/AMD/Nvidia support WDDM 1.2 rather than Win7's WDDM 1.1 (and Win7 will stay at WDDM 1.1); read up on wikipedia about the added features and stability of WDDM 1.2... that's an improved driver right there

you can also look at the driver signing date of most of the system drivers and find that they are newer than the ones that shipped out of the box in Win7 or earlier, which suggests that they were updated

if you're not having any problems with your existing config (performance, usability or otherwise) then I really can't convince you to upgrade, nor do I have any particular desire to do so (you see, despite my knowledge of Windows, I'm rather anti-Microsoft.)

it's really NOT going to "wow" you -- at best, it will make you pull your hair out until you pony up the $5 to buy Start8 to get back to where you were with Win7.

touchscreens are another matter entirely

NullUserException

@allquixotic I was looking for a user's perspective; most of the reviews out there have been mixed to negative

allquixotic

I'm a programmer like you. I'm perfectly fine with modifying my system to fit my needs, whether it's by installing a program, modifying the registry, changing group policy, whatever.

I don't tolerate things not working how I want them to work. I fix them. So instead of tolerating the horror that is Modern UI with a mouse, I simply reverted to the Windows 7 UI paradigm.

Now that I've done that, my review would be "it's fine" -- but out of the box I'd give it a 3/10 on touchscreen-lacking boxes

then again, almost any software that I intend to interact with for an extended period of time gets a 3/10 from me out of the box, until I have a chance to mold it to my use case and preferences.

with very few exceptions

NullUserException

@allquixotic Even Chrome ?

:D

allquixotic

5:35 PM

@NullUserException even Chrome. I have to install LastPass, Xmarks, Adblock, visit chrome://flags, tweak some preferences, and (at work) set up the proxy stuff and install FoxyProxy.

Don't get @OliverSalzburg started on Chrome modification. He loves it as much as I do, but tweaking it is half the fun.

NullUserException

@allquixotic You can sync bookmarks using a Google account

allquixotic

@NullUserException But not passwords, and you can't sync bookmarks to other browsers using a Google account (for instance, IE and Firefox)

I'm already half-house into Marvasol by mandate because I'm locked into LastPass, so I may as well install their other extension

NullUserException

@allquixotic Is LastPass like a in-browser KeePass?

allquixotic

Yes, where your keepass encrypted file is kept on the Marvasol servers, locked up tight as a fortress.

You can't observe the process yourself, of course, but I trade convenience for the potential that there might be a security issue because they take security so seriously.

NullUserException

@allquixotic I don't know why, but I personally would not want that

If they were compromised, I would lose access to everything

Call me paranoid but I trust no one

Except, maybe, Google

Oliver Salzburg

5:39 PM

:D

allquixotic

@NullUserException Well, someone here was saying the other day they were working on some kind of script or sync or something to store their KeePass file on Dropbox, and keep a keyfile on their systems and sneakernet it around. They were like, well, at least I can observe the encryption on my KeePass locker

Oliver Salzburg

I also would never use LastPass, but I keep my KeePass in my GDrive ;P

allquixotic

But the thing is, it's not like LastPass stores your data in plaintext. I'm absolutely certain of that. And each individual record in your database is separately hashed and salted, so even if they knew the salt, it'd grant them access to a whopping one of your accounts

they have so many layers of protection that you can hear your system groaning as it struggles to decrypt the data they send you

NullUserException

@allquixotic You can't hash and salt that stuff

You need the plaintext password, so it's encrypted at best

2

allquixotic

And how is KeePass any different? Symmetric encryption. Storing your symmetrically-encrypted data anywhere on the public Internet is the same security risk, or perhaps even worse if LastPass uses better crypto than your locker.

And if it isn't on the Internet, then you lose the convenience factor entirely, and have to sneakernet around your database and manually sync it between devices and operating systems, which just isn't worth my time.

Bob

5:43 PM

@allquixotic well, I do that, and have mentioned it here - recently. but no scripts involved...

allquixotic

Life's too short to worry about what would happen if some hacker gains access to 100 of my forum accounts and starts posting spam or hate speech in my name.

NullUserException

@allquixotic Sure, but this also introduces a single point of failure, doesn't it?

allquixotic

I memorize my credit card number. I don't store any financial data in LastPass.

NullUserException

@allquixotic That's really handy

I think everyone should do it (memorize CC numbers)

Bob

yay, I just broke somethign again

allquixotic

5:45 PM

@NullUserException The only alternative to having a single point of failure is to literally memorize every password for every account you ever create; don't write them down; and never repeat the same password.

Bob

either copying from Word crashes it, or it doesn't work at all

damn

allquixotic

The only thing that differs is where your single point of failure is.

Bob

and Word adds something to the Text format field, even when copying an image, so I can't reliably not-clobber existing text.

NullUserException

@allquixotic What I meant was, if LastPass goes down wouldn't you lose all of your passwords?

allquixotic

For some people, it's a card file. For others, it's a notebook. For others, it's LastPass. For others, it's KeePass. Everybody keeps their passwords somehow. Some people don't even bother with that, and just use the same password everywhere, which introduces multiple weakpoints and is categorically worse than having a password database and using a different password everywhere.

Bob

5:46 PM

I'm starting to hate how Windows and MS Office seem to have their own ideas of how a clipboard works

allquixotic

@NullUserException Three of my devices store an offline cached copy of the encrypted data (basically the same as a KeePass file) from the last time I authenticated, and it can be unlocked using your master password.

If LastPass went down and I lost access to all three of those devices, then yes, I'd lose all my passwords.

But on my Android phone (for example), I can have no Internet connectivity whatsoever, and, without planning ahead, I can just type my password, tick the offline mode box, and access my passwords.

NullUserException

@allquixotic I see

allquixotic

And they're stored in the NAND in a secure way, such that brute-forcing it would take an incredibly long time even for a supercomputer.

NullUserException

My paranoia comes from the reliance on this service: they (or an attacker who compromises them) could easily get your master password and thus all of your passwords

I don't have this risk with KeePass

Oliver Salzburg

Also, KeePass has QR Code support ;)

allquixotic

5:49 PM

As I understand it, your master password isn't ever transmitted over the network, not even in an SSL tunnel.

NullUserException

@allquixotic Yes, but it could be if someone maliciously modified their code

allquixotic

Basically, your master password is an entirely offline thing. Your encrypted data is transmitted to you (or anyone who knows your email address) just by requesting it of their server, but the encrypted data is useless without knowing the master password.

And since LastPass has no clue what your master password is, they are unable to disclose it, even if they were fully hacked.

All the hackers would gain access to are thousands of encrypted files. Step 3: procure 270 years' worth of compute time on all the Top 500 supercomputers in the world.

Then maybe your great-great-great-great-great-grandkids can benefit from your treachery by hacking into forum accounts on forums that have long been retired and taken offline.

NullUserException

@allquixotic What I meant was, what if the code was modified to send your master password (when you enter it) somewhere ?

allquixotic

@NullUserException The client-side code of the LastPass app, you mean?

NullUserException

@allquixotic Exactly

allquixotic

5:53 PM

I could ask the same about KeePass. Client security is a completely separate topic.

Any program where you enter a password on any input device, interface, etc. has the same liability.

Even a piece of paper has that liability.

It comes down to physical security.

NullUserException

@allquixotic Well, for one, KeePass is opensource. Also I could use stop it from connecting to the Internet entirely, because it really has no business doing so

Bob

...great, now I'm getting two different hashes for the same image

allquixotic

@NullUserException Right, which means that an extremely clever attacker could sneak in a commit that looks perfectly legitimate but has some nasty side effect of sending your password to them. I'm not saying I don't trust open source in the general case, I do; but if Debian's primary OpenSSL certificate generation mechanism can be compromised for years due to an innocent, non-malicious code cleanup, what, do you reckon, could be done if there were malicious intent?

A "strange" line of code in an otherwise-awesome feature addition commit to KeePass could end up being a backdoor. Not every committer audits every line of code down to the assembly level to ensure it isn't doing something nasty.

It could be as benign as putting a copy with weaker encryption in some cache on disk, or steganographically storing your data in a way that can be retrieved by an attacker who knows that your data is stored in a particular way. We can go in circles like this for hours once you start talking about client-side compromise.

Heck, both LastPass and KeePass are equally vulnerable to EM transmissions leaking out of your monitor, CPU, or input device and being picked up by the outside, while you're typing your password.

Why do you think the DoD has the TEMPEST program?

Tempest (codename)

Tempest (often spelled TEMPEST) is a codename referring to investigations and studies of compromising emanations (CE) (see Van Eck phreaking). Compromising emanations are defined as unintentional intelligence-bearing signals which, if intercepted and analyzed, may disclose the information transmitted, received, handled, or otherwise processed by any information-processing equipment. Compromising emanations consist of electrical, mechanical, or acoustical energy intentionally or by mishap unintentionally emitted by any number of sources within equipment/systems which process national securi...

NullUserException

@allquixotic But all that is rendered moot if I block Internet access for KeePass

I mean, realistically, for an average Joe like me, you wouldn't want to invest that many resources to steal my forums' passwords (I still memorize and use different passwords for banks and other important accounts)

allquixotic

@NullUserException And LastPass "requires" an internet connection to download the latest copy of the encrypted vault. I get it. But the problem eventually devolves to this: if your computer has an Internet connection at all, and any programs on your computer have unfettered administrative access and can run native code, then anything you type could, in theory, be transmitted over the internet, unless you block all Internet access to all programs.

That's true of every OS, in every environment, which is why environments requiring real security use the Air Gap method.

NullUserException

6:01 PM

The most logical avenue of attack would be to compromise LastPass, which would allow someone to harvest a ton of passwords

Bob

@allquixotic I don't think I'll bother supporting Word

allquixotic

Compromising LastPass itself is actually quite useless.

Bob

fixed everything else, great. then Word decides to pick the text if both text and image formats are available in the clipboard

allquixotic

Your encrypted vault is, essentially, public information. Anyone who knows your email can download it for free from LastPass with no authentication needed. They may as well provide your vault on a public directory on their webserver, keyed by an auto-incrementing ID.

NullUserException

@allquixotic For the purposes of injecting malicious code (to steal master passwords) into their client binaries

Bob

6:02 PM

facepalm

which kinda kills this idea

cause it breaks Word in the process

allquixotic

@NullUserException Oh. Yes. But KeyPass runs native code, too, so if you ever update KeePass, you're taking the same risk.

Risks involved include: (1) If you don't download the MD5/SHA sum over SSL, you could be MITM'ed into downloading a compromised binary; (2) Even if you completely block all traffic to KeePass, it could fork a randomly-named process into the background and do its evil stuff from there; (3) Even if the SSL cert is trusted, the guys who write KeePass could be evil and do bad things on purpose, shipping a malicious binary of their own free will.

So unless you download the KeePass source and audit it to the machine code level every time you update, it's really no safer than LastPass.

Even if you set your firewall to block KeePass and alert you to any Internet traffic from an unrecognized program, it's very likely that any program that is running arbitrary native code on your system can exploit a vulnerability, obtain root, disable the firewall, and then do its magic.

NullUserException

@allquixotic I suppose

allquixotic

Again, the thought experiment devolves into a simple cryptological scenario where client security is essential and, assuming client security is intact, the only thing you have to worry about is quantum computers.

NullUserException

Though from a functionality perspective, with LastPass you are restricted to accounts on websites, right?

Like if I had an encrypted PDF, it couldn't manage that password

allquixotic

Incorrect. You can store arbitrary data in LastPass. I don't know what the maximum file size is, but I have stored some fairly interesting data in LastPass.

It has a "Secure Note" feature where you can paste any textual data in there. For binaries, like SSH private keys, I use Base64 to store it.

I would be surprised if you were allowed to use more than, say, 100 MB for your entire vault, but it's not meant as a secure file store.

It's plenty to store a couple SSH keys and PGP keys and passwords though

Bob

6:09 PM

@allquixotic I think KeePass 2.x runs via .NET - so, not native :P

allquixotic

@Bob Even if it uses .NET or Java, unless it's running in a sandboxed environment, it can get to native code trivially.

The default behavior when double-clicking an exe, or running java, or whatever, is to assume full trust. Full trust leads to native, and native leads to "anything".

Bob

@allquixotic the point is, though, it is possible to audit the code. it's not possible to say what exactly LastPass is doing

allquixotic

@Bob Have you actually audited the code? Can you show me the formal or semi-formal proof of the mandatory security functionality of KeePass?

Having the ability to do something and then not doing it is not security; it's warm and fuzzy good feelings.

I'm all for Free/Open Source software, but that argument has been used so many times by people who don't actually audit their code.

And you have no reason to trust anybody else who might have previously audited it.

Their methods might have been faulty; they might have intentionally overlooked something.

Same is true of closed source, of course.

But still, claiming the ability as an advantage and then not availing yourself of that ability? It's a moot point.

What you're essentially doing by not auditing the code down to the machine level and formally verifying it is that you're emplacing trust in someone or something other than your own mathematical calculations, which is exactly what I do with LastPass. So we're on the same ground.

It's trust or spend a lifetime verifying it... you pick. I think most reasonable people pick trust.

Bob

@allquixotic I like my warm and fuzzy good feelings.

4

allquixotic

Anyway, that's the long and skinny of why I don't think LastPass is a risk any greater than the risk we take simply by connecting to the internet and using its conveniences and services.

Bob

6:15 PM

still, these aren't absolutes

you don't have to review it yourself

allquixotic

Surely it is a much greater risk to carry out any financial transaction where you provide payment information over the internet -- even over SSL -- because the sites that convey or receive that information are always under the most invasive possible attack to get at their valuable data.

I don't know about you, but I buy stuff on Amazon, Google, etc. all the time.... I consider that a greater risk than LastPass, and I do it every day almost.

Bob

the sheer amount of interest in popular (and open source) security programs increases the chance someone has reviewed it, (the chance) which will always be greater than a closed source program/website.

but, I'm not going to bother arguing this

allquixotic

In principle, I agree with you.

KronoS

If y'all haven't seen this, it's a pretty cool list of must have apps from reddit.

allquixotic

That's part of the reason why openly-documented protocols like OpenSSL are so resistant to attack.

Bob

6:17 PM

nothing is trustworthy, unless done yourself

but that's only for absolutes

there are many levels of 'good enough'

I simply choose the 'store this stuff locally in a transparent format'

whether that is more or less secure.. well, I have no idea

allquixotic

I don't think closed source adds any security, to be sure. Obscurity is useless at best and dangerous at worst. But I've seen enough of LastPass to know that it's "good enough" for me. The value of the convenience is so astronomically high compared to the offline alternatives that the nominally increased risk comes down to "...meh".

On an absolute level, it's the same. And since I can't even begin to calculate what kind of probability delta there is of a vulnerability between a closed source service and an open source program, the problem isn't even tangible in any sort of analytical sense.

It may be 0.0000000000000000000000000000000000000000000000000001 versus 0.001, or 0.0000000000000000000000000000000000001 versus 0.99. I don't know.

Just seems pointless to worry about it if I can't analyze it any more than "ooh, closed source scary stuff, might be evil"

Bob

sigh

I haven't even implemented the actual uploading code

allquixotic

then again, if you don't find the convenience of LastPass to be all that useful, then why take the risk? :P

everyone's sure to value that convenience factor differently, too, which must weigh into our own individual calculations of cost/benefit.

Bob

@allquixotic perhaps if I start using more than two devices :P

allquixotic

for example, a person who only ever uses one computer and doesn't have a smartphone would not care about having their info available on any device they use.

yeah, exactly

Bob

6:22 PM

it's trivial for me to synchronise a KeePass database between my desktop and laptop

allquixotic

I use about 12 devices, not counting spurious things like randomly visiting someone's house and they're like "can you check your email"

Bob

if I start introducing more devices, e.g. phone or even public devices (throwing security out the window), then LastPass may be more useful

allquixotic

have to dig out my email password, receive a text for 2-factor authentication from gmail, etc

it's all on my smartphone :)

Bob

LastPass or KeePass, if you enter your password on a public device, you may consider it compromised :P

allquixotic

true, lol

Bob

6:24 PM

@KronoS cool, missed that one

more accurately, that thread title didn't really interest me :P

NullUserException

@allquixotic I always assume there's a keylogger on whenever I use a device that's not mine

if I really, really have to access an important account I change the password later

KronoS

@Bob you migh also be intersted in this: blog.reddit.com/2012/12/…

Bob

@NullUserException always bring an internet-connected smartphone/laptop

NullUserException

@Bob I always try to, that's why I've only had to do that a handful of times

Bob

ah, this list: reddit.com/r/AskReddit/comments/14drdr/…

brings back memories

allquixotic

6:29 PM

how secure is cellular broadband? I wonder that sometimes

Bob

it's been a while since I needed to use those, thank god

allquixotic

obviously it's pretty good if you tunnel stuff over SSL, but what about sending plaintext over cellular broadband?

I honestly don't know

Bob

@allquixotic at least as secure as unencrypted/public wifi?

allquixotic

assuming the routing between you and the endpoint is secure - I'm talking about, like, physical security of grabbing it out of the airwaves

Bob

14

Q: Is data transmitted over 3G secure?

When data is transferred from my iPhone via 3G, is it encrypted, or is it relatively simple for a hacker to read the data that's transferred to AT&T's cell tower? What about after it reaches the tower?

iphone security

@allquixotic well, you can do just that with unencrypted/public wifi :P

> it's more secure than using free/unsecured WiFi hotspots/networks

NullUserException

6:31 PM

> 3G is encrypted, the most common encryption algorithms have been cracked,

WTF?

allquixotic

@NullUserException they may be referring to the fact that some crypto suites used on EvDO or HSUPA, etc. have been cracked

which may or may not be true, I don't know enough about the protocols used in cellular broadband

here's some useful info about the particular cellular broadband I use: radio-electronics.com/info/cellulartelecomms/…

Bob

note to self - avoid AskDifferent...

> Even HTTPS is secure only from non government or ISP level actors.

that has a score of 2...

allquixotic

@Bob wow

Sathya

nutty nuttersons

2

Q: The moderators have decided to have a little yuletide fun, join us will you?

PS: You only get so many Iceland Friday's in a year, so make it special people ... To start things off, a little refashioned seasonal tune: On the twelfth day of Christmas, my Stack Exchange gave to me: 12 inbox 'lerts 11 chatty pings 10 AnnaLears a Leaping 9 spam bots posting 8 weeks a fe...

discussion always-friday-in-iceland

allquixotic

I disagree that HTTPS is secure "only from non-government or ISP level actors" :-/

I mean, I hope government/ISP actors don't know how to crack the better cipersuites used in SSL/TLS

NullUserException

6:34 PM

18

Q: What is preventing us from sniffing the mobile phone communcation?

I'm learning wireless penetration testing. It really is amazing. But it made me wonder, what about mobile phones? They are also means of wireless communication. So, our entire voice must be in the air surrounding us. So, what makes it difficult to intercept? By the way, is there any standard l...

mobile sniffer phone sms

allquixotic

but you have to be pretty nutty to assume they can

Bob

@NullUserException I should've gone with the IT Security specific search, not the generic Google search :P

@allquixotic well, the guy mentions SSL you can guarantee security to the server, but the certs themselves come from a chain of trust.

allquixotic

so he doesn't trust the root CAs :D

cool beans

Bob

of course, that would have to be a pretty big conspiracy

allquixotic

I don't trust the root CAs, either. When I want to sign into Gmail, I drive to Mountain View, CA and hand them my password on a piece of paper. Sergei Brin signs me into the datacenter and lets me use a console at the end of a rack to read my email. Connected to https://localhost of course.

4

Speaking of security, I really would feel warmer and fuzzier if they would get over the "but performance!!!!!!!!!!!!!!!!!!oneoneoneone" and just give us https:// for the entire SE site.

If performance is a problem... hardware crypto modules. PCI-E.

KronoS

8:12 PM

Anybody here have office 2013 installed?

Luke

Yup

What's up?

KronoS

can you add this video to a powerpoint?

►

I keep getting this stupid error:

Luke

I get that too... I guess that it doesn't like iFrames

If we could use the old embed code, I'm sure it would work

KronoS

support.google.com/youtube/bin/…

According to that I should be able to get the old embed code

allquixotic

office 2013 is released as final?! whoa

KronoS

8:29 PM

@allquixotic no it's still in beta

or at least they aren't charging me for it yet :P

Luke

KronoS

Grrr.. I'm done with this. I'll just put a hyperlink to it

Luke

That code works

KronoS

@Luke You're a genius!

2

Luke

Thanks, and no problem :)

Luke

9:03 PM

That's gonna be the last one today, @allquixotic

allquixotic

@Luke cool, it only took three right-clicks and three left-clicks to return to a pictureless workspace :)

this is fantastic

Luke

9:21 PM

@allquixotic I know about that add on, but I have very little use for it on this computer :P

allquixotic

your pic spam is minuscule compared to what one of my facebook friends does... OMG

that person posts like 30 pictures on their timeline every night... i had to disable facebook notifications

random political statements, quotes, etc

Luke

I'd love to see those, but I don't have Facebook

allquixotic

i hate facebook and very rarely if ever sign in, but i made the mistake of authenticating myself into the app on my phone and it practically took over my phone

i had to uninstall it

Luke

I've seen that happen too many times

allquixotic

i'm okay with having a facebook account but it should stay in my web browser and leave me alone unless i specifically visit the site

if i'm not at the site i don't want to hear from it

Luke

9:32 PM

That too

allquixotic

i have a few friends who send me messages on facebook, but they're rare, and i always tell them afterwards to please email me (although a few repeat offenders apparently forgot how to use email once they discovered facebook)

Einsteins Grandson

hey guys

anybody here?

Luke

Nope, just us bots

0

A: Is 7200rpm thru sata 2 worth it?

Based on my first-hand experience developing firmware for disk controllers, here's an answer from a different perspective. You question seems to based on a misconception that, somehow, R/W_head-to-platter transfer rates affect the drive-to-host transfer rate. The reality is that these two I/O t...

Einsteins Grandson

9:59 PM

what are the softwares that can limit users

in windows 7

like right click etc

Transcript for