I have a fun story about turned on French people actually.
Not very fun for me, but rather amusing.
Took my girlfriend to Paris for our 1-year anniversary. Sat in a near-empty metro carriage, some guy gets on and sits directly opposite us on one of those 4-seats.
Originally I thought he was trying to perv on my girlfriend. How wrong I was.
About 2-3 mins into the journey, he kept trying to rub his leg against mine. I was freaked out, so made it perfectly obvious that I wanted him to stop by moving my leg away from him.
He did not stop.
Anyway, in the end we got off the train, and he was dubbed "creepy man".
I store password hashes in their full value for example, $h = sha256('foo') outputs 64 characters: 2c26b46b68ffc68ff99b453c1d30413413422d706483bfa0f98a5e886266e7ae
I store that directly in the database (along with salts, iterations, etc.).
My question is if I truncate that hash by 32 characters...
I think we need to choose or create a canonical Q/A for "I want to do something at work, but don't want my company to see it." questions - then close all others as dupe.
How transfer virus via pdf document? My goal is to format victim's hard drive when opening my infected pdf file. Now i have a pdf file and virus(.vbs file) to do this. But i don't know how to combine this. Please help me.
@RoryAlsop @AviD - It looks like user12102 could use some guidance in terms of what's acceptable for this site and not. Most of his Q/A lean strongly towards the dark side.
I'll assume the model you're trying to defend against is where an attacker has access to the database. If that's the case, yes, it's a bad idea if an attacker can compromise an account by only knowing those details.
My advice would be to convert the answer to uppercase, then salt + hash it. This...
the answers were nothing special. just the chessbird, mostly.
but the q's were definitely of interest...
> How transfer virus via pdf document? My goal is to format victim's hard drive when opening my infected pdf file. Now i have a pdf file and virus(.vbs file) to do this. But i don't know how to combine this. Please help me.
my comment:
> This is explicitly offtopic here - please see the FAQ. We do not allow any blackhat, unethical, or harmful questions here. On the other hand, I would strongly recommend you contact your local police department, to receive a stern talking to.
> Why everyone are very serious in this group? I am also a hacker i have 100s of gmail password. But i like some fun.If anybody agree please vote down and support me.
> Ho do spam attcak on gmail? [closed] How can i send 1000s of email to my friend's email inbox in every day? Is there any tools to do this type of attack? Please help me
Why everyone are very serious in this group? I am also a hacker i have 100s of gmail password. But i like some fun.If anybody agree please vote down and support me.
i already said. i have 100s of gmail password.if you take action i will login with another gmail account. This account also created by hacked password. — i am a hacker2 mins ago
@RoryAlsop What do you think of this one? I think it's borderline, possibly duplicate, and seems like it's trying to steer towards the dark side. I know you're handling the OP, but the low-rep responder looks like he's keen on following it down the black-hat path.
@RoryAlsop why have you closed security.stackexchange.com/questions/18411/…? Seems like it's not a duplicate. Linked question asks about whether captcha can be defated with CSRF attack though closed question is more general.
@AndreyBotalov Because the answers are appropriate. However if the consensus is that I am wrong, I'll reopen. What does the group think - did I close incorrectly?
@ScottPack he drinks a whisky libation, he drinks a vodka libation
I wasn't really having a problem with the duplicate, but that did add to it. My main concern was the direction the question (and one of the answerers) seemed to be aiming.
I got 30 negative vote and 6 question closed and 3 answer closed. even though i got 2 badges. Why stackexchange give me to badge? Is the mistake of project leader of the development team of stackexchange? (all about my older account that just suspended)
@Iszi no! But the reason is not the color of the asker's hat. It's because it's gimmetehcodez, shows no prior research, and is not answerable (an answer would have to be a complete series of exploits)
Note that I am for banning some back hat content: we should apply responsible disclosure rules, and forbid discussions of attacks against any specific real-life live system (no “how do I hack www.example.com”)
But no “you're trying to craft an attack -> delete”
@RoryAlsop I disagree with that
A dedicated black hat site is a recipe for disaster
2
All security content should be in one place, Sec.SE
If that proposal makes it through (fortunately, it probably won't, but it wouldn't be the first bad Area 51 proposal that went through), it'll be a cesspit
the hakerz will dominate the site
it will take Programmers-level moderation to keep the site afloat, and it won't attract experts
The Ps Tools from Mark Russinovich are very handy remote administration utilities. However, they all come with one big caveat.
Note that the password is transmitted in clear text to the remote system.
http://technet.microsoft.com/en-us/sysinternals/bb897553.aspx
Does this only happen when...
@Iszi I would say that “when do PS Tools send cleartext passwords” is more of an SU question and “how can I demonstrate this” is Sec.SE material
This is one of these cases where it might make sense to ask a question on each site, with the focus on one part on Sec.SE and on the other part on SU, and with links between the questions
Who found the password system in spain? How can exist Gmail and Facebook without password.(Quistion2) Anybody give me the link to see best password in the world?
@Gilles well, Everett's thoughts on scope aren't all black hat - he does think in terms of offensive there and defensive here, but that can be useful for professionals too
Proposed Q&A site for expert and hobbyist hackers, the type who
subvert security systems, who have problems with hacking techniques,
hacking inventions, and for hacker artists, and who seek knowledgeable
answers to these problems.
REVISION #3
Proposed Q&A site for experts a...
Yes. This topic excites me greatly. I see hacking as something more like lifehacker website. To me, you (@Highly Irregular) are very close with the answer to this question.
Your quote from Wikipedia harnesses most of the intent:
In home and hobby circles, a hacker is a person who heavily mod...
@RoryAlsop Well, I understand @Aarthi's concern about e-mailing people at addresses they haven't explicitly provided for contact purposes. But the address, I think, is still valuable for investigative purposes such as this.
@AlanBarber to be honest, mostly handled by the community - us mods are just the stick they wield, and when we can't help, the Devs and SEI folks are the final answer!
@xce Okay, I've been around @AviD on here enough to know when he's just playing around. But I can't quite tell with you, here yet. Are you seriously offended by that, or just continuing the jest?
@xce ahhh - I think that may be a misunderstanding. He was referring to the fact that recently there has been so much more traffic that whenever you pop on there may be hundreds of unread messages. In the early days we used to poke fun at each other when this happened
I don't recall a day when nobody was in here at all (then again, I wouldn't have been around to remember either of course) but there were definitely days where only a few people were around and nothing was said for 24-48+ hours.
@RoryAlsop Argh! Thought you meant the Meme thing. Had to scroll past the "bears" to check. That's going to become annoying, whenever I need to do something with that Q.
Whenever I come across one of the old security questions on U&L, it's usually you who has them right too - I don't think 'slowly learning about the topic' is quite correct :-)
Proposed Q&A site for experts/hobbyists who identify weaknesses in systems/designs, use irregular methods, create undocumented processes, test for weaknesses/methods to subvert IT security, have problems with cited techniques or using inventions specific to this testing.
Note that I am for banning some back hat content: we should apply responsible disclosure rules, and forbid discussions of attacks against any specific real-life live system (no “how do I hack www.example.com”)
Y'know... at some point, we might want to make some posts that actually link to the DMZ topic tags. But doing that would be a little tricky, without just ending up with a bunch of "on a boat" questions.
Big stone slabs, with akkadian script to little to be read from the ground level (not that many of the subjects could read, either). The point of the slabs was for the Law to be There, not really to actually enunciate the law.
@Gilles so you think there should be an element of ambiguousness in the rules, with the caveat that we will apply our discretion to the shadier ones? I can live with that.
@AviD Honestly, I can't see it working any other way. Even the FAW is pretty non-specific. If you get too specific in your strictures then you wind up forbidding good things and allowing the bad.
@ThomasPornin While your answer here is accurate and thorough, I don't see any commentary (from anyone else, for that matter) on the OP's question as stated. Could you add just a little detail to clarify whether or not hash truncation would actually inhibit or prevent an attacker from deriving the actual password?
Also, the effect on this community's reputation of having a member who boasts having stolen 100s of passwords and currently using a stolen GMail account for posting is... nightmarish.
It's not just the ethics of the questions, though that is a large and core part of it - it's also the types of users those Q&As will attract.
The kind of question I see as on-topic is: can I use this Acrobat Reader vulnerability to inject arbitrary code? Is this method for obtaining a local user's password by timing measures workable?
@AviD yes! We don't have to specify how many days to wait or what notification procedures to follow. Just saying “we apply responsible disclosure rules, and posts running afoul may be deleted” is enough
I store password hashes in their full value for example, $h = sha256('foo') outputs 64 characters: 2c26b46b68ffc68ff99b453c1d30413413422d706483bfa0f98a5e886266e7ae
I store that directly in the database (along with salts, iterations, etc.).
My question is if I truncate that hash by 32 characters...
Why everyone are very serious in this group? I am also a hacker i have 100s of gmail password. But i like some fun.If anybody agree please vote down and support me.
I got 30 negative vote and 6 question closed and 3 answer closed. even though i got 2 badges. Why stackexchange give me to badge? Is the mistake of project leader of the development team of stackexchange? (all about my older account that just suspended)
The Ps Tools from Mark Russinovich are very handy remote administration utilities. However, they all come with one big caveat.
Note that the password is transmitted in clear text to the remote system.
http://technet.microsoft.com/en-us/sysinternals/bb897553.aspx
Does this only happen when...
Who found the password system in spain? How can exist Gmail and Facebook without password.(Quistion2) Anybody give me the link to see best password in the world?
Proposed Q&A site for expert and hobbyist hackers, the type who
subvert security systems, who have problems with hacking techniques,
hacking inventions, and for hacker artists, and who seek knowledgeable
answers to these problems.
REVISION #3
Proposed Q&A site for experts a...
Yes. This topic excites me greatly. I see hacking as something more like lifehacker website. To me, you (@Highly Irregular) are very close with the answer to this question.
Your quote from Wikipedia harnesses most of the intent:
In home and hobby circles, a hacker is a person who heavily mod...
