« first day (759 days earlier)      last day (4126 days later) » 
08:00 - 23:0023:00 - 00:00

8:25 AM
> "The storm has passed. Now is the time to repair the damage." - Some wise leader, after destructive war @AviD, January '13
Also. I keep forgetting how much I love honey.
Perhaps I should change my face to Poo.
 
8:50 AM
 
 
2 hours later…
10:56 AM
so I'm thinking of doing a StackExchange CTF of our own. mainly focused on binary reverse engineering.
I've written 5 challenges so far, ranging from ridiculously trivial to a bit hard.
 
go for it
 
@Polynomial Interesting. You could consider approaching SEI to see if they would like to sponsor small prizes for it.
 
@TerryChia that is a possibility. I'd like to run a short beta before doing anything more serious though
 
@Polynomial will it be windows
or
llinux?
 
Windows.
 
11:00 AM
:<
well on the other hand
 
@TerryChia heh, just now ran across the petition response that was from. Didnt know what you were on about... Epic.
 
Reverse engineering is waaaay out of my league, but giving it a shot should be fun.
 
windows is still the most used platform
 
I don't really know anything about development on Linux.
 
@TerryChia It's not as hard as you'd think
 
11:00 AM
@LucasKauffman I thought Cloud was the most used platform...? ;-)
 
and a lot of this (at least later on stuff) relies on Win32-specific anti-debug tricks ;)
 
@LucasKauffman THATS WHAT SHE SAID!!
 
@LucasKauffman Yeah, but I still don't have a good grasp on assembly yet. Don't have the time atm to put in the effort to learn.
 
11:02 AM
@TerryChia you should still be able to do the first one ;)
 
I had a good free paper here about it somewhere
I also have this one, but the cover is not really inviting
 
@LucasKauffman hahaha! "not really inviting"?? Thats... an understatement.
 
@AviD Indeed.
 
I wanna slap that guy with his own damn clickey keyboard.
 
his forehead is the size of 400 regular foreheads
 
11:04 AM
looks like its kinda out of date, since like the invention of microprocessors.
 
On the topic of assembly, which architecture should I start from when I finally get around to learning it? x86 seems a little daunting for a beginner.
 
I'd go for x86 still.
 
I started with x86
 
all assembly is daunting. x86 is the most used, and it's actually not as complicated as it looks
 
@TerryChia its still the most common.
 
11:05 AM
unless you prefer ARM
 
also I think its logic is closer to programming logic.
 
once you know the syntax, the instructions just do one set thing each, which is easy enough to understand.
 
... if that makes any sense.
 
oh, and go for Intel syntax, not AT&T.
AT&T syntax is the devil.
 
actually @TerryChia ... I'm going to propose something truly crazy, but hear me out.
 
11:07 AM
@Polynomial I was reading through some assembly code, and I really didn't understand what the fuck it was all about, it looked as if everything was written inverse. It took me 1 hour to find out there was also another syntax for AT&T
 
Dont start with x86. Start with MSIL / CIL.
 
@LucasKauffman hehe
@LucasKauffman it's seriously retarded though, right? stuff like mov 4, *(eax)(3)
 
It's almost kinda assembly, and sooo much clearer. I think it might give you a good basis for "getting" assembly, and then moving on to real assembly later (though I've never tried it in that order). It's definitely much easier to learn...
 
I have no idea if that's valid. just looks about right for AT&T to me.
 
I havent seen that one
more like mov %eax,%ebx
 
11:08 AM
@AviD the only problem is if he's not familiar with C# internals.
 
where in intel it would be
mov ebx,eax
 
@LucasKauffman yeah, that's the one. but they use brackets to mean [], and move the offsets outside the brackets
 
@Polynomial fine, but I think it would still work if he's famliiar with any high-level OO language.
 
@AviD That might be an interesting way of doing it. Considering that I'm putting in some serious effort picking up C# now, it would certainly be cool doing it in parallel.
 
so mov [ebx+4], eax becomes mov %eax, ($ebx)(4) or something like that
which kinda makes me want to vomit
 
11:10 AM
@TerryChia well then, it would definitely help you understand the C# internals better, even if it doesnt help at all with assembly :)
which is really one of the biggest benefits of learning assembly, for a programmer...
 
@AviD Heh. I have no interest in becoming a programmer. My main motivation for wanting to learn assembly is reverse engineering.
 
11:28 AM
@TerryChia Oh, I figured as much. I was just sayin'.
Also, that was my interest in learning assembly - better understanding of how these compooter thiniges work.
which of course means that for the most part, once I understand it, I can safely forgot about 80% of what I learned, such as syntax.
Though there are some rare situations, that you really need to compile-dissassemble iin order to see what the program is really doing, and catch that very tricky bug.
Compilers are too smart for our own good.
 
Well, on the subject of programming. I have some issues which I hope you guys can shed some light on.
What is the best way to perform user authentication in situations where no sessions are involved?
The very specific scenario being a stupid school project I have to write to pass the module.
I have a windows form client written in C# that is writing to a database. I have to implement an authentication solution for it.
Ignoring the fact that it is stupid to have authentication code on a client, how should i go about doing it?
 
@TerryChia this.
I'm sure there are several questions about this already, but I'll let it slide :)
so just to understand - you have to write a C# client that access a db server directly?
 
@AviD yep... i know, it doesn't make sense to me either.
 
any possiblity of changing the architecture - put some appserver love in there?
@TerryChia no, it does make sense, just from a very academic point of view. Or a stupid one. But I'm going with academic.
 
@AviD well, it isn't in the requirements and I really don't have the time to write server code if it doesn't score me any extra points.
 
11:40 AM
@TerryChia well, it depends - are you being graded on real-world considerations, like performance, security, etc?
I would guess probably not.
 
@AviD probably not. this is coming from a lecturer who teaches the student sha1 + salt for password hashing.
 
:/
@TerryChia please show him oclHashcat on a GPU ;)
 
@TerryChia hey, that was commonly accepted wisdom not so long ago.
 
I'm considering just calling up the form if the authentication succeeds and ignore the fact it is hella easy to reverse engineer.
 
and point him to my "How to store salt?" answer.
 
11:42 AM
Any specific db?
If it's SQL Server - best bet, go with windows authentication throughout.
 
@AviD Microsoft Access facepalm
 
oh, I'm sorry, I thought you said a database.
 
haha
 
tell me, is authentication / access control even a requirement here?
 
@AviD yeah... reading the requirements made me really sad. :(
 
11:44 AM
Or can you just ignore it, for the purposes of the excercise?
 
@AviD yup it is. the module is actually called Secure Applications Programming
which is really ironic.
 
4
Q: Where/How is an ODBC password stored when 'saved' in Access?

GeneralBisonI have been working on a program that uses MS Access and ODBC to connect to an SQL server. One of the requirements is that the user need not know the password for the connection to the SQL server, so I checked the 'Save Password' check box when linking my SQL tables. Does anyone know where the p...

@TerryChia ouch. lolwat?
okay, wait wait. I know whats going on.
you're each going to have to break/defend your application, or each other's, from the class, right? RIGHT???
or you could show your prof this:
3
A: Changing windows client form values at runtime

AviDFirst of all, direct answer to your specific question: take a look at DDE, this can cause the VB form to change almost anything at runtime. However, I have a better answer for you: Odds are the VB client app is not using an encrypted protocol (such as SSL) - you can just intercept the network...

 
@AviD I really wish i could say yes.
 
@TerryChia tbf I've done that for classes of programmers. Was actually loads of fun, when it goes right.
and the devs really get it, better than all the frontal lectures I could give.
 
My diploma on a whole is pretty good, learnt quite a lot of stuff from it. The programming modules are what really sucked.
 
11:49 AM
tbh, at this point we have to assume that your prof doesnt really know enough to recognize a bad scheme when he sees it, but wants to see that you followed best practices whatever he taught you to do for "sehkooruhtee".
I think easiest solution - if it fits the req's - is to rely on NTFS permissions. I.E if you can access the file - you're gold.
with Access, anything else is pointless. Unless its to satisfy a teacher.
though he probably would want to see a ODBC passwords and such - see my answer above.
 
@AviD That last point is why I'm even spending time on this at all. :(
Thanks for the links though, i'll have a look through them.
 
@TerryChia I dont think you'll be surprised by anything there, perhaps some details to bring back to your teacher.
those are your two options tho - ODBC with pwds (stupid, better grades) or IWA / NTFS (less stupid, probably lower grade).
 
12:03 PM
-1
Q: What are the vulnerabilities of a social network ? (I would like to create one myself)

Martin E.I am currently enrolling in a computer science class, however haven't learned about databases or security on the internet in general. I have had a lot of programming and database experience before going to university though. So I do know how to handle a database to the extent for it to work prope...

So... much... fail....
 
@Polynomial Hi, I have this awesome idea that every one else is doing. I have no idea where to start but I am sure I can succeed. Will you please tell me what to do?
 
exactly.
 
oh come one! This is nothing like the other social networks! Here, the user will hardly be able to enter any text at all!
 
12:19 PM
1
Q: How long would it take my i-7 processor to factorise a 1024 bits number (consisting of just 2 prime factors)

jjk_42We're examining the RSA algorithm and would like to know how much time it would take an intel i-7 core (@ 2.50 gHz) to factorise the RSA-public key. we wrote a piece of java for this, and I don't know how effective it is public static String factorise(long l) { double a = Math.floor(Math.sq...

facepalm
 
today is going to be a great day for snark.
 
@LucasKauffman I think it's a once a month event.
 
where is that gif
where someone is dancing around when things are blowing up
I know how he feels
 
this one?
 
YES
from what movie is that?
 
12:26 PM
no clue. secreactions. Jim Carrey?
actually thought you were talking about this one?
 
@LucasKauffman I wish I knew. If you find out, let me know :P
I don't think it is Jim Carrey, actually.
I recognise his face, but I can't put a name to it.
 
12:41 PM
Have you guys heard much about BB10?
 
I don't follow BlackBerry news.
 
They have an interesting "anti-piracy" feature which I'm not sure if it's present in iOS/Android/WP.
Apparently a debug token has to be generated and loaded into the phone to sideload apps.
@Polynomial I don't either, but I attended a talk yesterday about porting Android apps to BB 10.
 
@TerryChia cool. did they also cover porting to PalmOS?
and I hope they covered Win98 while they're at it.
 
@AviD heh. Apparently BB 10 has a Android emulator for the Gingerbread version.
Which supports most of the Android APIs except for Google Maps.
 
@TerryChia OHHH. Well. Then. I think I'm going to run out and buy BB10's for my whole organization.
 
12:48 PM
@AviD Sarcasm aside, it is a pretty interesting way to get quick ports over to their platform for popular apps though. They have a conversion tool that does most of the heavy lifting.
 
@TerryChia Sure, it's probably quick, efficient, and mostly effective. But the question remains, why bother??
BB is now a distant 4th in the market, well behind even WP.
 
@AviD It's their last stand I guess. RIM is dead if BB 10 doesn't take off.
They appear to be putting in a lot of resources to convince developers to take a shot at their platform.
 
It's funny, you talking in possible future tense.
 
1:04 PM
I know the actor
but I cant think of his name
Willem Dafoe!
 
@LucasKauffman yes, that's the dude!
 
@LucasKauffman huh, yeah I guess it is.
Why didnt you just say Green Goblin?
 
cause I know him from other movies as well
 
no no, it's the Green Goblin.
So if thats who it is, I would guess Boondock Saints.
 
1:28 PM
This doesn't make sense to me: kickstarter.com/projects/1608380091/…
Surely the only people who will be interested in this would be the DIY crowd, who should probably be savvy find out that information for free on the internet.
 
2:01 PM
@Polynomial Do you happen to know a good bcrypt library for C#/.NET?
 
not off the top of my head, but Rfc2898DeriveBytes is an implementation of PBKDF2.
 
@Polynomial Ahh ok. I'll settle for that since .NET has a built-in implementation for PBKDF2. Certainly makes life easier.
 
indeed :)
 
2:20 PM
With a bit of editing, this could make a decent sec.SE question:
0
Q: Android Device Encryption

diagonalbatmanI am trying to understand when using the default android device encryption in 4.0.4 ICS (AES-CBC 128Bit) how the Key Derivation Function works? And how is the Decryption Password Stored and hashed on the device. I am trying to demonstrate points of potential vulnerability on our enterprise andro...

 
@TerryChia search for bcrypt on codeplex. or sourceforge.
57
Q: .net implementation of bcrypt

GarethDoes anyone know of a good implementation of bcrypt, I know this question has been asked before but it got very little response. I'm a bit unsure of just picking an implementation that turns up in google and am thinking that I may be better off using sha256 in the System.Security.Cryptography n...

 
One important question is how fast the implementation is.
 
@CodesInChaos I suppose the solution for that would be to use a Java implementation. :D
 
those slow hashes need a really fast implementation for maximum efficiency
And perhaps migrate this one as well:
3
Q: Does javascript "fake privacy" pose a security risk?

Steve BJavascript doesn't let you give private data or methods to objects, like you can in C++. Oh, well actually, yes it does, via some workarounds involving closure. But coming from a Python background, I am inclined to believe that "pretend privacy" (via naming conventions and documentation) is good ...

 
LOL
I wanted to look for fun stuff to do with raspberry pi
the first suggestion was siri
that's sad
 
2:31 PM
Yeah, Siri is hot. You should do fun stuff with her pi.
 
@ScottPack how is your kickstarter project going?
 
2:52 PM
not far off releasting the CTF stuff to you lot
got 5 levels done, just working on a simple site for it
What. The. Fuck.
 
@Polynomial What genius dreamed that up.
 
@TerryChia I truly hope you're using the term "genius" extremely loosely.
 
@Polynomial /sarcasm
 
ah
:P
 
3:30 PM
@LucasKauffman Eh?
 
3:52 PM
@ScottPack werent you making a keychain thingy?
for doing something with wires?
 
Must be another Scott Pack. Probably that guitar guy.
 
@ScottPack I thought that was you that had a project going to build a punchtool that fits on your keychain
 
4:11 PM
@LucasKauffman I have a project going for a punchtool that fits on the end of my wrist. I call it a "Fist".
 
@AviD How much is it going for?
 
@TerryChia two bits.
@LucasKauffman too bad that doesnt get oneboxed.
 
@AviD Do you have change for a byte?
 
@TerryChia sure, I've got five of them right here.
 
4:19 PM
BEST ADVERT EVAR.
new Cillit Bang ad
 
@Polynomial arguably, it would be better if we could understand what he is saying.
Silly accent.
 
haha
 
4:48 PM
@LucasKauffman Not me, it must be some other dashing young fellow who has made your life better.
 
5:38 PM
So I made the writeup for level1
level 2 was rather easy, took about 1 minute to solve
 
5:58 PM
@LucasKauffman wait, you need a script for that???
your script doesn't even enumerate all substitution ciphers (which would take a while), only rotations
 
@Gilles That's what I meant to do
because I thought it was going to complex, it wasn't <.<
I thought it might be bull, so I would hook it up to ssh and try to log in
 
you could at least have hooked your script to a dictionary, because it sure looked like this was three dictionary words
that would have made it more manageable: enumerate the substitution ciphers such that the ciphertext was a concatenation of three common English words
 
that would have taken longer and more lines of code no?
 
yes
but then I solved it with 0 lines of code: let's try rot13...
and if you wanted a script:
i=1
while [ $i -le 25 ]; do
  echo "$ciphertext" | caesar $i
  i=$((i+1))
done
 
ok guys, here's the Sec.SE CTF: poly.nomial.co.uk/sectf
let me know if there are any bugs in the site, or if you have any issues with the challenges
 
6:07 PM
> This site contains a range of reverse engineering challenges based on the Microsoft Windows platform.
 
indeed.
 
it's rough on people who don't have the OS to test their code
 
true, but 1) I don't know anything about Linux-specific anti debug
and 2) most people run Windows
we had this discussion earlier, and people agreed that Windows specific wasn't a problem
 
@Polynomial anyone can install a Linux VM
 
@Gilles see point 1.
I'm doing it in my spare time. Don't like it? Choose another CTF.
it's not part of the "official" CTF thing on meta anyway.
 
6:13 PM
@Polynomial It can be
 
I can get a Windows VM, but I barely have experience using it as an OS.
 
@Polynomial If you want that, I can add it :)
 
@LucasKauffman I guess, but I'd rather you guys give it a once-over before we publish it on the Meta thread.
anyway, level 1 is ridiculously trivial (you don't even need Windows to complete it really)
and it gets progressively more difficult.
currently 5 levels on there. will be adding levels as and when I get chance to make them
 
6:31 PM
one thing I'm working on is a "proof" page, which lets you prove to someone that you've completed a challenge, without giving away the level unlock code.
ok, just fixed a few glitches :P
 
@Polynomial what language is it written in?
 
@LucasKauffman the site, or the challenges?
site is PHP, challenges are in C with a lot of inline assembly.
 
6:50 PM
site :p
 
@LucasKauffman I started with 6809. So much simpler. So much cleaner, too. And... two stacks ! Now that is the right stuff.
 
@ThomasPornin evaluation stack and control flow stack?
I've forgotten the name of that architecture type, actually...
 
@Polynomial One of the stacks is used by the call/return opcodes. You do what you want with the other one.
 
yeah.
 
The usual name for an architecture with two stacks is a "two-stacks architecture"
 
6:57 PM
lol, I thought it had a proper name :P
 
It is very convenient to implement Forth
That's the kind of architecture where you bootstrap a full programming language in 2 kB of code.
 
yeah, it's nice and secure against typical stack buffer overflows too
 
A buffer overflow, on the stack or otherwise, is a shooting offence.
 
of course, but they exist.
 
So do automatic rifles.
 
6:58 PM
hehe
I reckon use-after-free is the next big thing.
already getting popular in browsers
 
Luckily those are hard to produce in C# :)
 
Automatic memory management does protect against use-after-free.
 
well C# is type safe anyway, so there's not really a risk of that kinda thing
@ThomasPornin unless there's a direct reference bug
 
unsafe and native interop are still dangerous
 
@Polynomial That's the lesson: don't fight your type system.
 
7:01 PM
GC moving memory around while you still have a pointer to it is nice
openssl-net has at least one of those
 
A GC is very nice, especially optimized GC (moving memory blocks allows for good optimizations), but it requires sticking to code with strong, unescapable types ("managed code" in .NET terminology) and it makes interface with native code more complex.
Ideally, don't interface with native code at all. Managed code all the way.
Is it me, or the list of "active" questions on the main page skips questions which have been too downvoted ?
 
One big pain is native APIs that keep the pointers you pass in for later use
@ThomasPornin yes it does
At least the "interesting" list does
 
Doesn't a question reaching -3 just disappear from the homepage?
I thought that was the number, anyhow.
 
I almost missed the "social network" question.
 
ah it was the homepage that doesn't list them, but if you're using "Questions" it'll be there
 
7:15 PM
@CodesInChaos GC Pin! :)
 
@Sadaluk -4
10
A: Meta sites' front pages should not hide questions with very low scores

Jeff AtwoodThe threshold is higher on meta, I think it's -8 or so compared to -4 on the parent site. Are you recommending that as the standard for all metas? I think I could support that. edit: setting this to a global value of -8 for all metas.

 
@Gilles Ah that was it!
 
@Polynomial Long term pinning isn't so great
 
@CodesInChaos Of course, which is why you should try to avoid long-term pinning.
 
The real horror are APIs that keep references to what you pass in
and expect those to be disposed in the correct order by you
 
7:17 PM
Pinning makes life quite harder for the GC and, correspondingly, for you
 
heh
 
(because of cache locality)
 
@ThomasPornin not necessarily, as long as performance isn't critical.
 
@Polynomial Performance is never critical, until it sucks badly.
 
exactly.
 
7:18 PM
For example I wrote a ogg/vorbis wrapper which breaks if you don't dispose manually, leaving it to the GC+finalization
 
performance is only critical when there's a critical performance problem.
;)
 
There is a very simple and efficient memory management technique, which is extremely safe and robust, but has some performance-related drawbacks.
 
Writing correct order critical finalization code was just too much work
 
It is called do-not-free.
 
The null-GC
 
7:19 PM
hehe
 
@CodesInChaos There is an article by Hans Boehm which explains that correct-order finalization is, in general, impossible to achieve.
 
In my case it would have been possible by implementing locks and ref-counting decrementing the refcount in the finalizer
It's just a real pain, especially together with critical finalization
So I decided that I'll just manually dispose everything and don't give a damn
 
With GC-based language, finalization is asynchronous (it must be asynchronous) so the bottom-line is: if you are doing some work in finalization then you are doing it wrong.
 
sometimes you need to, because the c api is so annoying
 
In Java there are Soft/Weak/Phantom references if you want to interact with the detection of unreachable objects by the GC.
 
7:24 PM
you can do weak referencing in C#, too.
pretty sure the class is called WeakReference
 
yeah. .net has no soft references though. No idea what Phantom references are
 
@CodesInChaos Phantom references are notified after the deed. The target object has already been released.
 
I don't think .net has those in the direct form, but you can probably build it using conditional-weak-references
 
He, I have snarked and the snarkee did not notice it: security.stackexchange.com/questions/27948/…
 
well at least implementing a basic social network is relatively easy
In game-dev forums the typical question is implementing an MMORPG
 
7:30 PM
indeed.
though "relatively" is a good word for it. it's "relatively" easy when you consider how much goes into a proper social network site.
 
The important part was the "basic".
 
exactly.
 
7:58 PM
for any of you in the US, check this out: petitions.whitehouse.gov/petition/…
regarding Aaron Swartz
 
8:26 PM
Cmon, lets be serious here. For the most part, even "proper" social networking sites are not really on the cutting edge of technology.
Very few "new" technological challenges to deal with.
 
it's not about technological effort, it's about the sheer volume of work.
 
Facebook in particular does have a few, such as supporting apps, oauth, and huge data.
@Polynomial oh sure. But it's not complex work.
 
indeed. there's just a lot of it :P
so many features that can work in so many ways.
 
I would say to build a typical socnet site, at least 90% of the work could be done by someone at the level of that OP.
 
I dunno. It'd be horribly insecure.
 
8:28 PM
many of them probably were, judging by their quality.
 
full of SQLi, XSS, CSRF, etc.
 
@Polynomial Of course. Whats your point?
 
probably RFI / LFI too.
 
@Polynomial like, I dunno, facebook in the first few years?
 
sure, but it was never quite that insecure.
it has those bugs, but as far as a huge webapp goes they didn't do too badly.
 
8:30 PM
some might argue that with FB's stance on privacy, the entire site is a lesson in purposeful in -security.
 
hehe, that's one annoying part of markdown
 
@Polynomial you forget, that FB wasnt always such a huge webapp.
 
of course
but I bet it wasn't quite as horrible as you might think
a few nasty bugs here and there, but it was at least using parameterised queries
 
@Polynomial do you know that for a fact?
I would say it's a fair assumption, but an assumption nonetheless.
 
I remember seeing it mentioned in one of the Facebook tech blogs.
 
8:33 PM
at least according to sorkin's portrayal, zuckerberg didnt seem the type to care about "best practices" and "security professionals". He always knew better.
 
the original design used parameterised queries with a particular technology, then they switched over to a special purpose-built data adapter that let them deal with all of the caching and other junk
 
Only HE could create such a brilliant copy of a dozen very simple websites.
@Polynomial since the beginning?
 
@AviD that's what they implied.
 
@Polynomial I'm not ruling it out, just saying it's not a foregone conclusion.
 
 
2 hours later…
10:08 PM
@Poly I'll have a poke at your ctf this week if I get a spare minute. Guessing it's i386 as you've used inline asm, right?
Microsoft handily removed that feature from the x64 toolchain.
 
@Sadaluk yeah, x86-32
 
In a decision akin to "what don't we need in Word?... How about paste? Yeah OK, deleting code..."
 
heh
 
@Polynomial Coolio, ok. And there's no hidden nasties in these... right??!! (I'll be using a vm anyhow) ;)
 
@Sadaluk nothing malicious. though obviously no warranty as to the accuracy, safety, etc. ;)
a.k.a. the "don't sue me" clause.
only 5 challenges so far, and you can do the first 2 in a half hour easy
 
10:12 PM
Ok. Well it always helps for people to be able to get into a challenge. Nobody wants level 1 to be "re-write Windows. Your time starts now. You have five minutes"
 
others are a bit harder and one requires some math to optimise a routine (not wanting to reveal too much though!)
oh, and make sure you write down the passwords or the level codes when you get to new levels, because it's all just stored in a session right now
no long term storage or anything :P
 
@Polynomial Aaah. Now that is good to know!
I usually keep the solution files floating around somewhere.
with a comment for the answer.
Right, sleep() time.
 
yeah, same
nn
 
10:38 PM
0
Q: How secure my server is... should I worry? How to increase protection

Digital RobotI updated my server yesterday to a new version of CentoOS including a new version of DirectAdmin panel. This new installation comes with Brute Force Monitor service. As far as I see, this BFM protects brute force tries. In just 24h of this new server, I see that my 5 sites had 10,000 brute force...

not sure it's on-topic on U&L: it's mainly about this Brute Force Monitor thing
should I recommend migration here?
 
08:00 - 23:0023:00 - 00:00

« first day (759 days earlier)      last day (4126 days later) »