« first day (3172 days earlier)   

12:56 AM
@MechMK1 Depends on how weak the RNG is.
@VipulNair I mean, it's some kind of puzzle. I have no idea who created it, but all the rumors about it are certainly false (it's no super genius recruiting people). It's just one of many different online puzzles.
@MechMK1 I would very strongly recommend against that. I don't know what System.Random uses, but if it uses an LCG, then it takes merely a few bytes to fully determine the RNG seed.
 
1:14 AM
@forest It's not. It's a subtractive generator, which is better than an LCG, though not by a lot. But the seedspace is too small. And it's not entirely thread-safe. So yeah, not a good option.
 
Ah
I imagine it's seeded with the current time?
 
By default, yes. There's an overload that allows you to supply your own seed...An Int32.
 
heh
So yeah, not good for passwords. :P
Fun fact: The Linux kernel uses an LFSR to generate (certain) secrets.
Including secret memory offsets and constant blinding values.
 
Nice. And I should mention that it isn't really an Int32...It's the absolute value of an Int32, so 31 bits.
 
gross
 
1:20 AM
Pretty much
 
CSPNRGs are so cheap now that I'm surprised they aren't used by default.
I mean, ChaCha8 would be able to replace rand() without a huge impact.
 
Yup
Plus they save you a lot of nonsense findings in SAST reports. :-D
 
If someone absolutely needs fast but insecure RNG, there should be a dedicated API for that.
@MechMK1 You know SQRL was created by the quack Steve Gibson, right?
 
 
7 hours later…
8:10 AM
Good morning, fellow ladies and gentlemen!
@Xander Now Playing: "The Instar Emergence" - "Circada 3301"
@forest But even then, if all you have is a hashed password, then there are no "few bytes" to begin with. I'd say attacking the status of a possibly weak RNG is the last thing I would do when cracking a password dump :D
@forest I have no idea who it is, nor do I myself particularly care about SQRL. But as mentioned above, someone claimed it was high security, practical, etc...
Also please forgive me, my fellow *hats, but my coffee is absolutely undrinkable today
 
8:57 AM
If they keyspace is reduced, it doesn't matter if you can't get the raw bytes.
 
What about upper, lower and digits? that's 62^20
For a 20 digit password
I'd argue even a password generated by a terribly biased RNG (e.g. 75% chance for 1, 25% chance for 0) would be secure under these circumstances
 
9:19 AM
I mean, I don't have a bad RNG at hand, but just as a thought experiment:

`dd if=/dev/badrng bs=20 count=1 | base64 -e | sha256sum`
Great how the formatting doesn't work.
Anyways, I think that this "password" will still be relatively secure
 
 
2 hours later…
10:55 AM
14
Q: DMA attacks despite IOMMU isolation

forestIf you're already familiar with PCI behavior and Linux's handling of DMA buffers, skip to the third section for my actual question. Otherwise read on for a small summary of how PCI devices perform memory accesses, and how the kernel handles communicating with devices using DMA. I've included this...

@forest What exactly is the question? I mean, it's detailled an everything, but I have no idea what the answer should even look like
 
11:51 AM
Can someone who isn't caffeine-deprived tell me if I am wrong here, please? chat.stackexchange.com/rooms/97768/…
 
12:21 PM
He is confusing between attacking a hash with rainbow table and dictionary attack
@MechMK1 you are right as far as i know
 
12:44 PM
@MechMK1 You are not wrong.
As an aside, this "By using pre-computation, you (or someone else) perform the "heavy lifting" beforehand. Comparing a found hash with an already existing one is very quick and only requires "looking it up" in the existing hash database." is pretty archaic. Computational power is so cheaply and readily available these days that that rainbow tables are not really a thing any more.
For the last decade or so the cost of hash computation has been generally low enough that it's cheaper than storing and looking up the hashes.
So, while that was certainly originally true and the theory still holds, in practice modern computers have dumped the theory on its head.
 
1:33 PM
@Xander I always assumed the widespread adoption of salts made prehashing infeasible
 
2:03 PM
@MechMK1 Yes certainly, that is true performance aside. But even for unsalted hashes it isn't a particularly efficient approach any longer.
 
2:19 PM
@Xander Thank you, that's quite interesting to learn!
1
Q: How do I use Npcap?

GhawblinI'm trying to packet capture a remote system using Wireshark on my primarily windows environment. I want to sniff out SMBv1 and HTTP traffic. I've read this was possible using WinPCap, but it's been discontinued and isn't secure, and that the newer Npcap is the recommended way to do. I'm testin...

Is this question on-topic? I'm a bit torn on it
I'd tend to say it's on-topic, but we had several similar "How do I use X?" that got closed
Perhaps migrate it to Super User? We migrated quite a few nmap questions there
 
@MechMK1 Yeah, I'd agree that it's a better fit at SU. @JourneymanGeek what say you?
 
Looks alright
Kick it over
Or vote to kick it over I guess
 
@JourneymanGeek Done.
 
@JourneymanGeek Same
 
3:21 PM
Sorry about that NPcap question guys. I'm fairly new to the innerworkings of the culture and posting requirements.
 
@Ghawblin No worries! That's why we have the ability to vote to move it around. :-)
 
@Ghawblin No worries. Migrations are not a punishment, but a tool to help a question find the right audience.
47
A: Defense against attacks using dictionaries

MechMK1Attackers often don't just use dictionaries, but also rules which permute the words in dictionaries. For instance, a rule could be to substitute certain letters for numbers, which look the same. This would turn Password into P455w0rd. A rule, which could apply in this case, would be to remove s...

Somebody just claimed that a random password is not better than a dictionary word, then quickly deleted their comment when I replied :D
 
3:37 PM
@MechMK1 it appears to be very specific
#51455001
 
NIST guidelines here lately have recommended long passwords with no complexity being a good solution. "mycarhasfourdoorsandisblue" is better than "P@$$w0rD!?"
I agree with your statement
 
@Ghawblin And I agree with this. My password is 45 characters long.
But the idea that MyCarIsBlue and +v6NmqEV>fs are "of equal security" is wrong.
 
Oh absolutely
 
The best possible password is a password that is long and random
Nobody will crack QSRX/(XkymWE}_zyL8xD{Wn#Q5/wH96ajB2/!Tkng33Nq - ever.
But if you have to remember a passphrase (e.g. the master key to your password manager), then a long passphrase is absolutely the best choice
 
I'm a security engineer for an org with 4000 users and have to work best with "what is reasonably secure" and "what can 70 year old Margaret remember". When I proposed 12 character minimums I could feel the dread in the room
 
3:42 PM
@Ghawblin My personal recommendation: Use the word "Passphrase" everywhere
Instead of password
 
That's a good one.
 
And in every example, use things like "ThisIsGoingToBeAGreatDay"
And really make users understand: "Long does not mean unrememberable"
users are afraid of having to remember QSRX/(XkymWE}_zyL8xD{Wn#Q5/wH96ajB2/!Tkng33Nq
But still, tell them to use at least one "unique" thing, such as a name or a location
Like MyDogDidn'tLikePeopleNamedBarbara
 
@Ghawblin Why not use phrases or shopping list
 
I'm planning on rolling out this new 12 character change to a single department populated by older admin staff and see how they go. These are good tips for me to play with
 
@Ghawblin One final advice: Run cracking software against your user database. If your software can crack it, an attacker can for sure.
Because many users still default to something like Winter_2019!, because it satisfies uppercase, lowercase, special and digits, plus it's 12 characters long
But still a shit password :D
 
3:47 PM
It's a hospital, so literally everything has a password. Thankfully I've got almost everything to RADIUS back to AD so users need just one password. I'm actually researching right now how to pull AD passwords (I'm assuming a hash list?) to run against a rainbow table and cracking software.
And yeah, we're going to have users for sure using <6 letter obvious phrase><year><! and ?>
 
@Ghawblin That'd be a good question to ask here. State the context, why you want to do it, etc.
And I worked in a hospital IT too
I feel your pain, trust me
Anyways, I gotta go home now. See you guys around
 
4:16 PM
Later!
 
4:36 PM
Did i just took a very BIG risk?
@forest If one can answer your mysterious question, i'll be happy
 
 
7 hours later…
11:44 PM
 

« first day (3172 days earlier)